Legal

→ Privacy policy

Information per § 5 DDG (Digital Services Act, German implementation)

Alexey Sokolovskiy Business designation: Alex Sokolov · Data Protection & IT Security

Baumstr. 15 47445 Moers Germany

Contact

Phone: +49 2841 9496-220 Email: alex@alex-sokolov.de

Small-business status (§ 19 UStG)

Pursuant to the small-business rule under § 19 of the German VAT Act (UStG), no value-added tax is charged or shown. A VAT identification number is therefore not maintained.

Activity

Freelance consulting for data protection and IT security. This is not a regulated professional title; the activity is governed in particular by:

• GDPR (EU Regulation 2016/679)
• German BDSG (Federal Data Protection Act)
• German TDDDG (Telecommunications-Digital Services-Data Protection Act)
• German DDG (Digital Services Act)

No legal services within the meaning of the German RDG are provided; data protection consulting is rendered within § 6 RDG (general legal information) and § 38 BDSG (external data protection officer).

Responsible for content per § 18 (2) MStV

Alexey Sokolovskiy (address as above)

Consumer dispute resolution

I am neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board.

Liability for content

As a service provider I am responsible under § 7 (1) DDG for my own content on these pages, in accordance with general statutes. Under §§ 8 to 10 DDG I am, however, not obliged as a service provider to monitor third-party information transmitted or stored, or to investigate circumstances that suggest unlawful activity.

Obligations to remove or block the use of information under general statutes remain unaffected. Liability in this regard, however, is only possible from the time at which I become aware of a specific infringement. Upon becoming aware of such infringements I will remove the relevant content immediately.

Liability for links

My offering includes links to external websites of third parties whose content I cannot influence. For this reason I cannot accept any responsibility for that third-party content. The respective provider or operator of the linked pages is always responsible for their content. Linked pages were checked for possible legal violations at the time of linking. Unlawful content was not detectable at the time of linking.

A permanent content review of linked pages is not reasonable, however, without specific indications of a legal violation. Upon becoming aware of legal violations I will remove such links immediately.

Copyright

Content and works on these pages created by the operator are subject to German copyright law. Reproduction, processing, distribution and any kind of exploitation outside the limits of copyright law require the written consent of the respective author or creator. Downloads and copies of this site are permitted only for private, non-commercial use.

To the extent that content on this site was not created by the operator, the copyrights of third parties are respected. In particular, third-party content is identified as such. If you nevertheless become aware of a copyright infringement, please inform me. Upon becoming aware of legal violations I will remove such content immediately.

Note on translations: The German version of this imprint is legally binding. Translations into English and Russian are for information.

→ Impressum DE · Выходные данные RU

Last update: 2026-06-11. Reference to the EU online dispute resolution platform removed (platform discontinued 2025-07-20, Regulation (EU) 2024/3228).

Version: 2026-07-01

→ Imprint

1. Controller

Controller within the meaning of the GDPR:

Alexey Sokolovskiy Business designation: Alex Sokolov · Data Protection & IT Security Baumstr. 15 47445 Moers Germany Phone: +49 2841 9496-220 Email: alex@alex-sokolov.de

→ Full mandatory disclosures: Imprint.

2. General notes

The following notes provide a simple overview of what happens to your personal data when you visit my website, view my social media profiles, or contact me by email. Personal data is any data that can identify you personally.

This policy covers:

• the website alex-sokolov.de (DE/EN/RU)
• email communication to *@alex-sokolov.de
• my professional Instagram profile @alex_sokolov_itsec
• my associated Facebook page (Meta platform; serves solely the technical administration of the Instagram profile; Messenger is deactivated)
• any WhatsApp channel (broadcast) I may run, and any WhatsApp Business contact

3. Web hosting and server logs

This website runs on a virtual server managed by me at STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The server is located in Germany; hosting involves no third-country transfer.

When you visit this website, the web server transiently processes your IP address and connection data as technically required to deliver the requested pages.

No access logs: The web server is deliberately configured without access logging. No visitor logs are stored — no IP addresses, no requested pages, no browser identifiers. Only technical system and error messages without systematic personal reference are kept briefly in the system journal and rotated automatically.

Legal basis of the transient processing: Art. 6 (1) (f) GDPR (legitimate interest — delivery and secure operation of the website).

Processing agreement: A data processing agreement per Art. 28 GDPR is in place with STRATO GmbH (server infrastructure).

4. Contact by email

If you contact me by email, your details (email address, name if provided, message content) are processed to handle the enquiry.

Legal basis: Art. 6 (1) (b) GDPR (pre-contractual steps) or Art. 6 (1) (f) GDPR (legitimate interest in efficient communication).

Retention: Emails remain in the mail file for as long as required for the engagement, and at minimum according to statutory retention obligations (German HGB / AO, up to 10 years).

Mail hosting: mailbox.org (Heinlein Hosting GmbH, Berlin, Germany). A processing agreement is in place.

5. Instagram profile and Facebook page (Meta)

I operate a professional profile on Instagram (@alex_sokolov_itsec) and an associated Facebook page (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland — “Meta”). The Facebook page serves solely the technical administration of the Instagram profile; Facebook Messenger is deactivated. When you visit my profile or page, comment on a post, react to a story, or send me a direct message, Meta processes your data on its own responsibility; for certain processing operations I act as a second joint controller.

5.1. Joint controllership for Insights

For the statistical evaluations Meta provides me about visitors of my profile or page (“Instagram Insights” / “Page Insights”), Meta and I are joint controllers under Art. 26 GDPR. Basis:

• CJEU judgment C-210/16 (“Wirtschaftsakademie Schleswig-Holstein”, 5 June 2018) — profile/page operators are jointly responsible for Insights processing
• Meta’s “Page Insights Controller Addendum” — as operator I am bound by this addendum; available at https://www.facebook.com/legal/terms/page_controller_addendum

This joint controllership is limited exclusively to Insights. For all other processing (account data, advertising, tracking outside my profile, cookies, device identifiers) Meta is solely responsible.

5.2. Data categories processed (Insights)

Meta provides me with aggregated statistics only:

• number of profile/page visitors per day/week
• demographic breakdown (age, gender, region) exclusively at aggregate level
• reach and interactions of my posts and stories
• time and frequency of visits

I receive no personal data about individual visitors from Meta — only aggregated statistics. What data Meta collects beyond that on its own responsibility (e.g. cookies, device IDs, movement profiles within Meta platforms) is outside my knowledge and control.

5.3. Direct messages and comments

My Meta presences serve reach only; no substantive consulting takes place there. If you nevertheless send me a direct message (DM) or comment on a post, I process this content solely to redirect you to a secure channel (email, phone). No substantive handling takes place via Instagram/Facebook. Meta additionally stores the content on its own servers.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest — redirection to an appropriate communication channel).

Retention: I delete incoming DMs/comments after redirection, at the latest after 30 days.

Switch to a secure channel: For any matter, in particular confidential ones and from engagement initiation onward, please use email (mailbox.org, see §4) or phone. Instagram DMs are technically unsuitable for confidentiality (readable by Meta, no E2E on my account).

5.4. Third-country transfer (USA)

Meta transfers data to the USA. The transfer is based on the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023, Decision C(2023) 4745) and, additionally, on EU Standard Contractual Clauses.

5.5. Your rights vis-à-vis Meta

For data access, deletion requests and objections towards Meta, contact Meta directly:

• Meta privacy policy: https://privacycenter.instagram.com/policy/
• Privacy enquiries to Meta: https://www.facebook.com/help/instagram/contact/505535973176353

For the joint Insights processing (§5.1), both controllers are points of contact — you may also contact me directly (alex@alex-sokolov.de).

5.6. Voluntariness / alternatives

Using my Meta presences is voluntary. If you prefer not to transfer data to Meta:

• my profile can be viewed without an Instagram account — avoid logging in
• contact is alternatively possible by email (§4) or phone
• all essential content also appears on this website

6. WhatsApp (channel and WhatsApp Business)

Provider: WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (Meta group; group headquarters in the USA). These presences, too, serve reach only; no substantive consulting takes place there.

6.1. WhatsApp channel

I may run a WhatsApp channel as a one-way broadcast channel: I publish content that subscribers can receive. I receive no phone numbers and no identity data of subscribers — these are not visible to me. Comments are not possible; subscribers can only react with emoji.

6.2. WhatsApp Business

In addition, a WhatsApp Business contact may be reachable. No substantive consulting takes place there either. I process incoming messages (phone number, display name, message content) solely to redirect you to a secure channel (email, phone) and delete them afterwards. In doing so I do not access my device address book; no third-party contact data is transferred to WhatsApp.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest — public presence and redirection to an appropriate communication channel).

Retention: I delete incoming messages after redirection, at the latest after 30 days.

6.3. WhatsApp’s own responsibility / third-country transfer (USA)

The processing of subscriber and user data (e.g. phone number, usage data) is carried out by WhatsApp/Meta on its own responsibility under its own terms: https://www.whatsapp.com/legal/privacy-policy-eea. WhatsApp/Meta also transfers data to the USA — on the basis of the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and, additionally, EU Standard Contractual Clauses.

7. Cookies

This website sets no cookies other than technically necessary ones (e.g. language preference). There is no web analytics, no conversion tracking, and no advertising pixels.

If extended features are activated in the future (e.g. appointment booking, newsletter signup), this policy will be extended and — where required — consent obtained per § 25 of the German TDDDG. As long as this note is here, that is not the case.

8. Your rights

You have the following rights at any time:

• Access (Art. 15 GDPR) — what data I process about you
• Rectification (Art. 16 GDPR) — correction of inaccurate data
• Erasure (Art. 17 GDPR) — deletion, unless retention obligations apply
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Complaint to a supervisory authority (Art. 77 GDPR) — competent: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 200444, 40102 Düsseldorf, Germany

Requests to alex@alex-sokolov.de. Reply within one week on working days; statutory deadline 30 days.

9. TLS encryption

This site uses continuous TLS/SSL encryption with automatic certificate renewal for security and confidentiality.

10. Changes to this privacy policy

This policy is updated upon material changes. Current version: see date above.

Change history: 2026-05-17 full review (MVP start) · 2026-05-25 Instagram section adapted to reach-only · 2026-06-11 hosting section switched to STRATO (Germany) — formerly Hostiman, the third-country transfer (Russian Federation) no longer applies; appointment-booking section removed (service not in operation); Facebook page added to the Meta section; sections renumbered; no-access-log configuration documented. · 2026-07-01 WhatsApp section added (channel as broadcast, WhatsApp Business as a redirect inbox without address-book access); sections from Cookies onward renumbered.

Note on translations: The German version is legally binding. The EN and RU translations are for information.

→ Datenschutzerklärung DE · Политика конфиденциальности RU