Privacy notice

1. Controller

CHnet Solutions Plus UG (haftungsbeschränkt), represented by managing director Christian Holbein. Bahnhofstr. 2, 37339 Breitenworbis, Germany. Contact: hello@chnet.solutions.

2. Hosting

This website is hosted on Amazon Web Services (region eu-west-1, Ireland) and delivered through Amazon CloudFront (edge locations worldwide; for German visitors typically Frankfurt). A data processing agreement is in place with AWS. On request, technical server logs (IP address, timestamp, user-agent, path) are kept in CloudFront and S3 logs for at most 90 days, exclusively for security and diagnostics purposes.

3. Cookies and local storage

Without your consent we only store in your browser what a feature you use requires (§ 25 (2) no. 2 TDDDG):

Only with your consent are the Google Analytics cookies _ga and _ga_WP6EY45EW6 added (section 4). The contact form, the chatbot and Search Console set no cookies; the fonts are served from our own server. The link to the booking page (section 12) sets no cookie on chnet.solutions. When you book an appointment in the chatbot, Cloudflare Turnstile in the booking form and on the confirmation page accesses browser characteristics as far as needed for the booking (section 12).

4. Web analytics with Google Analytics 4 (only with consent)

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor.
• Only with consent: On your first visit a notice appears at the bottom of the page with the equally weighted buttons “Accept” and “Decline”. Only after “Accept” does your browser load Google’s script and set the analytics cookies. Before that and after “Decline” there is no connection to Google. Without JavaScript no notice appears and nothing is measured. Your choice applies to chnet.solutions; chnet.domains asks separately.
• Purpose: We want to understand which pages are used in order to improve content and usability.
• Data: a random identifier of your browser (cookie _ga), the pages viewed and the referring page (each without query parameters), time and duration, device, browser, screen size, language and the approximate location (country, region) that Google derives from the IP address. According to Google, Google Analytics 4 does not store the IP address. Entries in the contact form and the chatbot are not sent to Google.
• Settings: Google signals and advertising features are switched off; there is no personalised advertising and no link to Google Ads or a Google account. In Consent Mode the advertising consents are always denied (ad_storage, ad_user_data, ad_personalization).
• Cookies: chnet_consent (your choice, 12 months), _ga and _ga_WP6EY45EW6 (Google Analytics, 2 years).
• Retention at Google: Google Analytics deletes the event data after 2 months; afterwards only aggregated reports without reference to an identifier remain.
• Third country: Google Ireland may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); standard contractual clauses apply in addition.
• Legal basis: your consent, Art. 6 (1)(a) GDPR and § 25 (1) TDDDG. Consent is voluntary; if you decline, you can use the website without restriction.
• Withdrawal: at any time with effect for the future via the “Cookie settings” link at the bottom of every page. If you choose “Decline” there, we delete the cookies _ga and _ga_WP6EY45EW6 and load no more analytics. You can also delete the cookies in your browser.

5. Search Console

The domain is verified for Google Search Console. A verification meta tag is added to the HTML response; this entry does not set cookies.

6. Contact form

If you use the contact form, your data (name, email, subject, message) is transmitted to an AWS Lambda endpoint in eu-west-1. Submissions are stored in a DynamoDB table in the same region. Retention: 12 months, then automatic deletion. Legal basis: Art. 6 (1)(b) GDPR (pre-contractual measures) or (f) (legitimate interest in efficient request handling).

7. Chatbot

The chatbot embedded on this site answers questions about Christian Holbein and CHnet Solutions and can book appointments (section 12). It runs via an AWS Lambda endpoint in eu-west-1 that calls Amazon Bedrock (Anthropic Claude, EU inference profile). Conversations are stored in a DynamoDB table in the same region. When you use the chatbot, in addition to the conversation content we also store the IP address and User-Agent of the calling browser for 90 days. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in spam-/abuse-detection); this data is not shared with third parties and is automatically deleted after 90 days.

8. Chatbot lead submission

If your conversation with the chatbot turns into a concrete project inquiry, the bot can — only after explicit, on-the-record confirmation from you — submit a qualified summary to the same database as the contact form (section 6). The bot is required to summarise the planned submission first and to wait for your unambiguous “yes” before any data leaves the chat.

• Data categories: the request text (a qualified summary of the planned project, rough size, timeline, optionally tech stack), and optionally name and email address if you provided them in the conversation.
• Purpose: forwarding to Christian Holbein for initial contact and proposal preparation.
• Legal basis: Art. 6 (1)(b) GDPR (pre-contractual measures taken at the request of the data subject).
• Storage location: AWS DynamoDB table chnet-contact-submissions in eu-west-1 (Ireland). No third-country transfer.
• Retention: up to 365 days after receipt, then automatic deletion. You can request earlier deletion at any time via privacy@chnet.solutions (alternatively hello@chnet.solutions).
• Recipient: Christian Holbein, owner of CHnet Solutions Plus UG. No further parties receive this data.
• Appointments: if the chatbot books an appointment for you, section 12 applies. The appointment request is not a lead submission and is not stored in this table.

9. Domain search and domain suggestions

We offer the domain search and AI domain suggestions on chnet.domains (the former page chnet.solutions/domains/ redirects there); they are operated by the domain portal of CHnet Solutions Plus UG (haftungsbeschränkt). The data processed (availability checks with the registries, Amazon Bedrock in the EU, Cloudflare Turnstile, caches of five minutes for available and 24 hours for registered names) is described in the privacy policy of the domain portal (German). We do not store what you enter in the search or for the suggestions. We do not record analytics events for the domain search.

10. Bot insights & quality control

To improve the chatbot’s answer quality, a nightly Lambda in eu-west-1 reads the conversations of the past 24 hours from the DynamoDB table mentioned in section 7 and uses AWS Bedrock (EU inference profile) to check them automatically for recurring weaknesses, comprehension gaps or missing vita content. It leaves out conversations from automated tests.

• Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in improving service quality).
• Bedrock inference: transient — conversation content is only handed to the model for the duration of the check; AWS does not train on or store this data. No third-country transfer.
• Analysis by email: at most once a day, Christian Holbein receives the analysis by email (sent via Amazon SES from noreply@chnet.solutions, received via Microsoft Exchange Online, section 11). It contains counts per category and up to 15 short excerpts from conversations (your message and the chatbot’s answer, at most 160 characters each). We replace email addresses and phone numbers with placeholders; the email contains no IP address, browser identifier or conversation id. An excerpt may contain a name you mention in the chat. The email goes to nobody else.
• Retention: we delete the emails automatically 30 days after receipt; for technical reasons they are permanently removed no later than 60 days after receipt. We keep the state of the analysis (which day was reported) for 90 days in an internal table in eu-west-1.
• No additional data: beyond section 7, we collect no further data.

11. Email

Email to hello@chnet.solutions is processed via Microsoft Exchange Online (Microsoft Ireland Operations Ltd.) under the Microsoft data processing agreement.

12. Booking appointments (Microsoft Bookings)

You can book an appointment in two ways: on our booking page at Microsoft Bookings or in the chatbot. Both create the appointment in Microsoft Bookings (part of Microsoft 365).

• Provider: Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as our processor (Microsoft Products and Services Data Protection Addendum).
• Booking page: the page opens at Microsoft; it is not embedded on chnet.solutions, and the link alone sends no data to Microsoft. There you enter the appointment, the type of meeting, your name, your email address, optionally your phone number and a message. When you open the page, Microsoft also processes your IP address and technical data of your browser. Cookies on the booking page are covered by Microsoft’s notices (link on the booking page).
• Booking in the chatbot: the chatbot asks Microsoft for free slots; for this we send only the time range and the type of meeting, no personal data. For the booking it shows a form for your name, your email address and a topic (at most 200 characters); the chosen slot and the language are added. The form data goes directly to our booking service at AWS, not to the AI model and not into the stored conversation (section 7). We do not copy the conversation into the appointment.
  • Confirmation by email: we store the request for at most 30 minutes in a database at AWS in Ireland (eu-west-1) and send you an email via Amazon SES from noreply@chnet.solutions with the appointment and a confirmation link. The link works once and for 30 minutes. Only after your confirmation do we create the appointment in Bookings via Microsoft’s interface (Microsoft Graph); Microsoft then sends you the booking confirmation. We then remove your details from the request. If you do not confirm, we delete the request after 30 minutes.
  • Protection against automated access: the booking form and the confirmation page are protected by Cloudflare Turnstile (Cloudflare, Inc., USA). The script loads only when the form appears. Turnstile processes browser characteristics and your IP address at Cloudflare; we send only the token to Cloudflare for verification.
  • Abuse protection: so that nobody books in someone else’s name, we limit requests per IP address (at most 10 a day) and per email address (at most 2 a day). For this we store only hash values, which expire after 24 hours.
• Purpose: arranging and holding the appointment; confirmation, reminder and cancellation by email. For an online meeting Bookings creates a Microsoft Teams link.
• Storage location: in the calendar of our Microsoft 365 account (Exchange Online) in data centres in the EU (Microsoft EU Data Boundary).
• Third country: in individual cases, for example for support or security, Microsoft may transfer data to Microsoft Corporation in the USA. For Turnstile, Cloudflare, Inc. processes data in the USA. Both companies are certified under the EU-US Data Privacy Framework (Art. 45 GDPR); standard contractual clauses apply in addition.
• Legal basis: Art. 6 (1)(b) GDPR (pre-contractual measures taken at your request); for the email confirmation, Turnstile and the request limits Art. 6 (1)(f) GDPR (protection against bookings in someone else’s name and against abuse). Turnstile accesses your browser only as far as needed for the booking you asked for (§ 25 (2) no. 2 TDDDG).
• Retention: we delete appointments and your details in Bookings, and the copy of the appointment in Christian Holbein’s calendar, no later than 12 months after the appointment. If an order results, the statutory retention periods apply.
• Cancelling or changing: via the link for managing the booking in Microsoft’s booking confirmation or by email to hello@chnet.solutions. The chatbot does not cancel appointments.

13. Your rights

You have the right to information, correction, deletion, restriction of processing, data portability and objection at any time (Art. 15-21 GDPR). Please direct any requests to hello@chnet.solutions or privacy@chnet.solutions.

14. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority is the Thuringian Commissioner for Data Protection and Freedom of Information (registered office of the controller: Breitenworbis, Thuringia).

15. Changes

This privacy notice will be updated when the technical setup or applicable law changes. Last revision: 27 October 2026.