Skip to content
Metareq
Search articles
Book an initial consultation
Consultation
Open menu
MetareqClose menu
Book an initial consultation
mehrshad.ansari@metareq.comMember of BITMi

Privacy Policy

Last updated: 09/11/2026Version 0.2

Contents

1. Controller and contact details

The controller responsible for processing personal data on this website is:

MetaReq GmbH
Bergener Str. 23
30625 Hannover
Germany

Represented by Managing Director Mahsan Kaviani Baghbadorani.

Telephone: +49 176 56769849
Email: mehrshad.ansari@metareq.com

If you have questions about data protection or wish to exercise your rights, please contact us using these details. Our contact person for data protection enquiries is Mehrshad Ansari Jouybari.

2. Scope of this Privacy Policy

This Privacy Policy explains how we process personal data when you visit our website, contact us or subscribe to our newsletter.

Personal data means information relating to an identified or identifiable natural person. This includes, for example, names, business contact details, message content and IP addresses.

This Privacy Policy applies to our website at prod2.metareq.de. Websites operated by other providers and linked from our website are subject to their own privacy policies.

We process personal data only where a legal basis exists. Depending on the processing activity, the following legal bases may apply:

  • Article 6(1)(a) GDPR, where you have consented to the processing;
  • Article 6(1)(b) GDPR, where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract;
  • Article 6(1)(c) GDPR, where processing is necessary to comply with a legal obligation;
  • Article 6(1)(f) GDPR, where processing is necessary for our legitimate interests or those of a third party, unless your interests or fundamental rights and freedoms override those interests.

The relevant purposes and legitimate interests are explained in the following sections.

4. Hosting and provision of the website

Our website is hosted by:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

When you access our website, technically necessary connection data is processed. This includes, in particular:

  • the IP address of the requesting device;
  • the date and time of access;
  • the pages and files requested;
  • the volume of data transferred and technical response codes;
  • browser type, browser version and operating system, where transmitted by your browser;
  • the previously visited page, where this information is transmitted.

We process this data to deliver the website, maintain its functionality and stability, and detect and investigate technical errors or misuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website.

Hetzner processes hosting data on our behalf.

Retention of access logs: IP addresses in our web server’s access logs are stored for 14 days and subsequently deleted through regular log rotation.

Where there are specific indications of a security incident, the log extracts necessary for investigating that incident may be retained separately until the matter has been resolved and, where necessary, for the establishment, exercise or defence of legal claims. Such retention is limited to the data necessary for that purpose.

The storage of IP addresses in web server logs is separate from the hashing used in our form systems, as described below.

Further information about the provider:
https://www.hetzner.com/de/privacy-policy-notice/

5. Contact by email or telephone

If you contact us by email or telephone, we process the information you provide. This may include your name, contact details, company affiliation, the content of your enquiry and subsequent correspondence.

We use this information to handle your enquiry, ask follow-up questions, arrange discussions and, where appropriate, prepare a business relationship.

Where your enquiry concerns entering into or performing a contract with you, the legal basis is Article 6(1)(b) GDPR.

For other enquiries, particularly where you act as a contact person for a company, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is handling business enquiries and communicating with prospective customers, customers and business partners.

Providing your data is voluntary. Without suitable contact details or sufficient information, we may be unable to respond to your enquiry.

The retention of correspondence is explained in Section 12.

6. STRATO email services

We use services provided by the following company to send, receive and store business emails:

STRATO GmbH
Otto-Ostrowski-Straße 7
10249 Berlin
Germany

The data processed includes, in particular, sender and recipient addresses, message content, attachments and technical delivery information.

STRATO processes this data on our behalf to provide email services.

STRATO is also used to send acknowledgements of receipt for contact form submissions and confirmation emails for newsletter subscriptions.

The legal bases depend on the purpose of the communication, as explained in the sections on contacting us, the contact form and the newsletter. The technical provision and security of our business communications are also based on our legitimate interest under Article 6(1)(f) GDPR.

Further information about the provider:
https://www.strato.de/datenschutz/

7. Contact form and introductory consultation requests

Data processed and purposes

If you use our contact form, we process the information you enter and the technical information listed below:

  • name;
  • company;
  • email address;
  • telephone number, if provided;
  • the subject of your enquiry;
  • the size of your organisation;
  • message;
  • language;
  • the time at which you acknowledged the privacy notice;
  • hash values of your email address and IP address.

Required information is identified by the mandatory fields marked in the form.

The data is transmitted to our own backend and stored there to handle your enquiry. Authorised personnel at Metareq can access the data through our internal administration system to manage the enquiry.

We also transfer lead and contact data to our customer relationship management system, HubSpot. Further details are provided in Section 8.

We process the data to handle your enquiry, prepare an introductory consultation, contact you and, where appropriate, prepare a proposal.

The legal basis is Article 6(1)(b) GDPR where processing is necessary to take steps at your request before entering into a contract or to perform a contract with you.

For enquiries made on behalf of a company or other business enquiries, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the organised handling and follow-up of business enquiries.

Acknowledging the privacy notice documents that you have taken note of it. It does not constitute consent to newsletters or other advertising.

Acknowledgement of receipt and internal notification

After submitting an enquiry, you receive an acknowledgement of receipt by email. This does not include the content of your enquiry.

Metareq receives an internal notification, also without the enquiry content. It contains a link to the enquiry in our internal administration system.

Protection against misuse

We use the security measures described in Section 7b to protect the form. These include a locally operated ALTCHA check and technical limits against repeated or automated requests.

Retention

Contact enquiries stored in our own form system are deleted after 365 days.

Where an enquiry results in a business relationship, or certain records are required to meet legal obligations or safeguard legal claims, the necessary data may continue to be retained in the relevant business records. Section 12 applies to this data and to separate storage in email and CRM systems.

Voluntary provision of data

Providing your data is voluntary. Without the information marked as required, you cannot submit the form or we may be unable to handle your enquiry adequately.

Submitting a contact enquiry does not automatically subscribe you to our newsletter.

Please do not use the form to submit health data, other particularly sensitive personal data or confidential personal data concerning third parties that is unnecessary for your enquiry.

7a. Newsletter and double opt-in

Subscription and data processed

You can subscribe to our newsletter using the subscription form on our Insights page.

When you subscribe, we process:

  • your email address;
  • your selected language;
  • the time of registration;
  • the version of the consent text displayed when you registered;
  • the source of the registration, particularly the form used;
  • a hash value of your IP address.

We use this information to process your subscription, provide the newsletter in accordance with your consent, prevent misuse and maintain a record of the registration.

Confirmation of the subscription

We use a double opt-in procedure. After entering your email address, you receive an email containing a confirmation link, sent through STRATO.

Your subscription is completed only after you follow the confirmation link and then confirm the subscription on our website.

The confirmation link is valid for seven days. Unconfirmed registrations, including the stored email address, are deleted after seven days.

Processing for registration and newsletter delivery is based on your consent under Article 6(1)(a) GDPR in conjunction with Section 7(2), point 2, of the German Act Against Unfair Competition (UWG).

We document the registration and confirmation procedure to demonstrate your consent. The legal bases are Article 6(1)(c) in conjunction with Article 7(1) GDPR and, where retention is necessary to defend against legal claims, Article 6(1)(f) GDPR.

Separate processing to prevent misuse is based on Article 6(1)(f) GDPR. Our legitimate interest is preventing unauthorised registrations, unwanted confirmation emails and automated misuse.

You may withdraw your consent at any time with effect for the future, particularly through the unsubscribe function provided or by contacting the email address in Section 1.

Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

When you unsubscribe, your email address is deleted from active newsletter management without undue delay. It is then no longer used to send you the newsletter.

After you unsubscribe, we retain a limited record of your previous consent. This includes, in particular, the times of registration, confirmation and unsubscription, the version of the consent text and the source of the registration.

Your email address is not stored in plain text in this record, but only as a hash value. Such a hash value does not amount to complete anonymisation.

The record is retained until the end of the third calendar year following the year of unsubscription and is then deleted. For example, if you unsubscribe in 2026, the regular retention period ends on 31 December 2029.

The record is not used for further advertising. Where longer retention is necessary in a specific case for the establishment, exercise or defence of legal claims, it remains limited to that purpose.

7b. Form security using ALTCHA and technical request limits

Locally operated security check

To protect our contact form and newsletter registration against automated misuse, we use a self-hosted version of ALTCHA.

Your browser solves a mathematical challenge using a proof-of-work procedure. The challenge is supplied and verified by our own backend. No data is transmitted to an external ALTCHA service to perform this check.

The check does not use cookies or persistent browser storage. It is not used to track your behaviour across different pages.

A challenge is valid for ten minutes and can be used only once.

Processing of IP addresses

For technical request limits, our website forwards the IP address of your connection to our own backend.

The backend does not store the IP address in plain text. Instead, it generates a cryptographic hash value using a secret key through an HMAC procedure. The hash value is stored with the contact enquiry or newsletter registration and used to limit misuse.

The IP address relates to the internet connection. It does not necessarily identify a particular browser or individual.

Email address hashes are also used to limit repeated confirmation messages and, for the newsletter, to associate consent records with an address.

Hashing makes it more difficult to access the original information directly. Nevertheless, the hash values are protected as personal data.

Processing an IP address in the form backend is separate from its storage in web server logs. The latter is subject to the 14-day retention period described in Section 4.

We limit, in particular, the number of form submissions, newsletter registrations, confirmation emails and security challenges within specified periods.

The purposes are to protect against spam and automated attacks, prevent unwanted emails being sent to third parties and maintain the availability of our systems.

The legal basis for processing personal data is Article 6(1)(f) GDPR. Our legitimate interest is providing secure forms with safeguards against misuse.

Where technically necessary information is stored on or accessed from your device for the security check, this takes place on the basis of Section 25(2), point 2, of the German Telecommunications and Digital Services Data Protection Act (TDDDG).

If the security check is unsuccessful or a technical limit is exceeded, submission may be temporarily unavailable. Alternatively, you can contact us using the details in Section 1.

8. Customer relationship management with HubSpot

We use HubSpot as a customer relationship management system to organise prospective customer and business contact information.

Our contractual service provider is:

HubSpot Germany GmbH
Am Postbahnhof 17
10243 Berlin
Germany

We transfer lead and contact data from contact enquiries to HubSpot. This includes the information necessary to manage the contact, particularly names, business contact details and company affiliation, where provided.

The purposes are to assign and handle enquiries, organise follow-up communications, and prepare and manage potential business relationships.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the efficient and traceable management of business contacts. Where processing is necessary to enter into or perform a contract with you, it is based on Article 6(1)(b) GDPR.

HubSpot acts as a processor on our behalf. Companies within the HubSpot group and other subprocessors may be involved in providing the service. Personal data may therefore also be processed outside the European Union or European Economic Area, particularly in the United States.

HubSpot’s data processing terms provide, in particular, for the European Commission’s Standard Contractual Clauses for relevant international transfers. Details of these safeguards are available in the terms linked below or may be requested from us.

Data Processing Agreement:
https://legal.hubspot.com/dpa

Subprocessors:
https://legal.hubspot.com/sub-processors-page

HubSpot Privacy Policy:
https://legal.hubspot.com/privacy-policy

9. Cookies and similar technologies

We currently do not use analytics or advertising tracking services to analyse your browsing behaviour or create advertising profiles.

Where information is stored on or accessed from your device and this is strictly necessary to provide a website function you have expressly requested, this takes place on the basis of Section 25(2), point 2, TDDDG.

Any associated processing of personal data is based on Article 6(1)(f) GDPR. Our legitimate interest is providing the requested website functions securely and reliably.

In our implementation, the ALTCHA check described in Section 7b does not use cookies or persistent browser storage.

The use of storage or access technologies that are not strictly necessary generally requires your prior consent. If we introduce such functions in the future, we will inform you before they are used and obtain any required consent.

The fonts used on this website are hosted locally. Loading them does not require a connection to an external font service.

Our website contains links to external services, including LinkedIn, Instagram, YouTube and the German Federal Association of IT SMEs (BITMi).

Merely displaying an ordinary link does not establish a connection to the linked website. When you follow such a link, you leave our website. The respective provider then processes data in accordance with its own privacy policy.

11. Recipients of personal data

Within our company, personal data is accessible only to individuals who need it to perform their duties.

Outside our company, the following categories of recipients may receive data:

  • hosting and IT service providers;
  • providers of our email services;
  • providers of our customer relationship management system;
  • professional advisers subject to confidentiality obligations, where necessary in an individual case;
  • authorities, courts or other bodies where disclosure is legally required or necessary for the establishment, exercise or defence of legal claims.

Where service providers process data on our behalf, we engage them in accordance with Article 28 GDPR.

12. Retention and deletion

The following retention periods apply, in particular, to the processing activities described:

  • IP addresses in regular web server access logs: 14 days;
  • contact enquiries in our own form system: 365 days;
  • unconfirmed newsletter registrations, including email addresses: seven days;
  • email addresses in active newsletter management: until unsubscription, followed by deletion without undue delay;
  • limited consent records following newsletter unsubscription: until the end of the third calendar year following the year of unsubscription.

Automatic deletion of a contact enquiry from the form system does not automatically mean that all associated data is deleted simultaneously from email accounts, the CRM or business records subject to retention obligations.

For separate email correspondence and CRM data, the relevant criteria include whether the enquiry is still being handled, whether a specific business relationship or business opportunity remains active, or whether further retention is necessary on another legal basis. Once the relevant purpose no longer applies and there is no other legal basis, the data is deleted.

Documents subject to commercial or tax law retention requirements are retained for the applicable statutory period. Longer retention may also be necessary where data is required for the establishment, exercise or defence of legal claims.

Data retained solely for these obligations or legal claims is not used for other purposes without a separate legal basis.

Your statutory rights, particularly to erasure, restriction of processing and objection, remain unaffected.

13. Your rights

Subject to the applicable legal requirements, you have the following rights:

  • access to your personal data under Article 15 GDPR;
  • rectification of inaccurate data and completion of incomplete data under Article 16 GDPR;
  • erasure of your data under Article 17 GDPR;
  • restriction of processing under Article 18 GDPR;
  • data portability under Article 20 GDPR, where processing is based on consent or a contract and is carried out by automated means;
  • objection to certain processing under Article 21 GDPR;
  • withdrawal of consent at any time under Article 7(3) GDPR, with effect for the future.

Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

To exercise your rights, please contact us using the details in Section 1.

14. Right to object

Where we process personal data on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.

We will then stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing, you may object to that processing at any time. This also applies to profiling insofar as it relates to such direct marketing. Following an objection, the data will no longer be processed for these purposes.

For the newsletter provided on the basis of your consent, you may withdraw that consent at any time as described in Section 7a.

15. Right to lodge a complaint

Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law.

You may contact, in particular, the supervisory authority of your habitual residence, place of work or the place of the alleged infringement.

The supervisory authority generally responsible for our company is:

Der Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5
30159 Hannover
Germany

Website: https://www.lfd.niedersachsen.de
Online complaints: https://www.lfd.niedersachsen.de/beschwerde

16. Automated decision-making

For the website use and enquiry handling described in this policy, we do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

The automated security check and technical request limits are used solely to protect our forms. If a technical block occurs, you can contact us using the details in Section 1.

17. Data security

We implement appropriate technical and organisational measures to protect personal data. Data transmitted through our website is encrypted using HTTPS.

Our safeguards include, in particular, restricted access rights, the technical request limits described above and hashing of certain information in the form system.

Please note that ordinary email communication does not guarantee end-to-end encryption. Please contact us in advance to agree on a suitable method for transmitting particularly confidential information.

18. Updates to this Privacy Policy

We update this Privacy Policy when our processing activities or applicable legal requirements change. The current version is available on our website.

Questions about this text?

Write to us at mehrshad.ansari@metareq.com.

Get in touch