Privacy Policy

Last updated: 17 October 2026

1. Overview

This Privacy Policy explains how personal data is collected, processed and stored when you visit this website or use the contact form. This website is operated by Burag Gurden, an independent sustainability and strategy consultant based in Berlin, Germany. I am committed to protecting your privacy and handling your data in accordance with the EU General Data Protection Regulation (GDPR).

2. Data Controller

Burag Gurden
Reinhardt Str. 3A, 12103 Berlin, Germany
Email: contact@greenblueorangeconsulting.com
Phone: +49 1575 3320075

I act as the data controller for all personal data collected through this website.

3. What Data Is Collected

3.1 Contact Form

When you submit the contact form, the following data is collected:

• Full name
• Email address
• Company / organisation (optional)
• Service interest (optional)
• Message content

This data is submitted via Netlify Forms and stored on Netlify's servers in the United States. Netlify acts as a data processor under GDPR. For more information, see Netlify's Privacy Policy.

3.2 Analytics

This website uses Google Analytics 4 to collect anonymous traffic data, including page views, session duration, and approximate geographic location. Google Analytics is loaded only after you give explicit consent via the cookie banner. If you decline or make no choice, no analytics script runs and no analytics cookies are set. GA4 does not store IP addresses, and no advertising or remarketing features are enabled. The data is used solely to understand website usage and improve content. You can withdraw your consent at any time via the “Cookie Settings” link in the footer, after which no further analytics data is collected.

The Satoshi typeface is self-hosted on this website's server. Font files are served directly from greenblueorangeconsulting.com and are not loaded from external font-delivery services. No IP address or browser user-agent data is transmitted to third-party font providers when you visit this site.

3.3 Server Logs

Netlify (the hosting provider) may collect standard server logs including IP address, browser type, referring page and timestamp. These are used for security and technical troubleshooting only and are retained for a limited period in accordance with Netlify's data retention policies.

3.4 Cookies

This website sets Google Analytics 4 first-party cookies (_ga and _ga_*) for anonymous traffic analysis only if you accept them via the cookie consent banner. If you decline, no analytics cookies are set. No advertising, remarketing, or third-party tracking cookies are used under any circumstances.

Additionally, a small preference flag recording your consent choice (accepted or declined) is stored in your browser's localStorage. This is not a cookie, does not contain personal data, and is not transmitted to any server. You can change your choice at any time via the “Cookie Settings” link in the footer.

You can disable GA4 cookies at any time by using the Google Analytics Opt-out Browser Add-on or by adjusting your browser settings to block cookies from this domain.

3.5 Collaboration Form

When you submit the collaboration form, the following data is collected:

• Full name
• Email address
• Primary expertise area
• Website and LinkedIn profile URL (optional)
• Collaboration pitch / description
• Document type (e.g., Resume, Portfolio, Case Studies, Statement of Work, Proposal)

This data is submitted via Netlify Forms and stored on Netlify's servers in the United States. It is used solely to evaluate partnership opportunities and respond to your enquiry.

3.6 File Uploads

The collaboration form allows you to upload documents (PDF, Word, PowerPoint, or ZIP files, maximum 10 MB). Uploaded files are transmitted securely via HTTPS and stored by Netlify alongside the form submission. Files are retained for up to 24 months and are accessible only to me for the purpose of reviewing collaboration proposals. I do not share uploaded documents with third parties. If you wish to have an uploaded file deleted before the retention period expires, contact me at contact@greenblueorangeconsulting.com.

3.7 Chatbot & Conversation History

The help chat widget stores conversation history and user preferences (such as whether the chat window is open or closed) in your browser's localStorage. This is not a cookie and does not transmit personal data to third parties. The data remains on your device and is not sent to any server. You can clear this data at any time via your browser settings. No personally identifiable information is collected through the chatbot unless you voluntarily include it in your message.

3.8 CBAM Estimator Assessment Request

When you request an assessment on the CBAM cost estimator page, the following data is collected: name, company, work email address and a summary of the estimate you calculated (country, CN code, volumes and the resulting cost figures). This data is submitted via Netlify Forms and used only to answer your request.

3.9 Newsletter and Checklists

If you subscribe to the newsletter or request a checklist, your email address, the checklist you chose and the page you signed up on are collected via Netlify Forms and passed to the email service MailerLite (MailerLite UAB, J. Basanavičiaus g. 15, LT-03108 Vilnius, Lithuania), which acts as a data processor under GDPR.

Subscriptions use the double opt-in procedure: you receive an email asking you to confirm your address, and you only receive newsletters or checklist emails after confirming. The time of signup and confirmation and your IP address are logged to document your consent. A checklist request also sends two follow-up emails over the following two weeks with a related case study and a booking link.

The emails measure whether they are opened and which links are clicked, so that I can see which topics are useful. Every email contains an unsubscribe link, and you can withdraw your consent at any time by using it or by writing to me; open and click data is then no longer collected.

4. How Your Data Is Used

Your personal data is used solely for the following purposes:

• To respond to your enquiry, consultation request, or collaboration proposal
• To prepare for and conduct professional discussions or partnership evaluations
• To maintain a record of business correspondence and partnership opportunities
• To analyse anonymous website traffic patterns and improve user experience (via Google Analytics 4)
• To send the newsletter and requested checklists, including the follow-up emails, if you have subscribed

Apart from the newsletter and checklist emails you explicitly subscribe to, I do not use your data for marketing, advertising or any purpose unrelated to your original enquiry. I do not sell, rent or share your data with third parties except as required for hosting (Netlify) or legal compliance.

5. Legal Basis for Processing

Under GDPR Article 6, the legal basis for processing your contact form data is legitimate interest (responding to your business enquiry) and, where applicable, consent (your voluntary submission of the form).

The legal basis for the use of Google Analytics 4 is your explicit consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TTDSG, given via the cookie consent banner. You may withdraw this consent at any time with effect for the future via the “Cookie Settings” link in the footer; the lawfulness of processing prior to withdrawal remains unaffected.

The legal basis for the newsletter and checklist emails, including open and click measurement, is your consent pursuant to Art. 6(1)(a) GDPR, confirmed through double opt-in. You can withdraw it at any time with effect for the future. Logging the signup and confirmation is based on my legitimate interest in being able to prove your consent (Art. 6(1)(f) GDPR).

6. Data Retention

Contact form, collaboration form and CBAM assessment request submissions, including any uploaded files, are retained for up to 24 months from the date of submission, after which they are deleted. If we enter into a professional engagement, relevant correspondence may be retained for the duration of the engagement plus any applicable statutory limitation period.

Your newsletter and checklist subscription data is kept until you unsubscribe. After that your address is removed from the mailing list; it may be kept on a block list so that you do not receive further emails, based on my legitimate interest in respecting your choice. Unconfirmed signups are deleted if they are not confirmed.

7. Your Rights

Under GDPR, you have the following rights:

• Right of access, Request a copy of your personal data
• Right to rectification, Request correction of inaccurate data
• Right to erasure, Request deletion of your data ("right to be forgotten")
• Right to restriction, Request limited processing of your data
• Right to data portability, Receive your data in a structured format
• Right to object, Object to processing based on legitimate interest

To exercise any of these rights, contact me at contact@greenblueorangeconsulting.com. I will respond within 30 days.

8. Data Security

This website uses HTTPS encryption for all data transmission. Contact form data is transmitted securely to Netlify's servers. I take reasonable technical and organisational measures to protect your data against unauthorised access, loss or alteration.

9. International Data Transfers

Contact form data is processed by Netlify in the United States. Netlify participates in the EU-US Data Privacy Framework and provides Standard Contractual Clauses (SCCs) for GDPR-compliant international data transfers. For details, see Netlify's Data Processing Addendum.

Google Analytics 4 data is processed by Google LLC in the United States. Google participates in the EU-US Data Privacy Framework and provides Standard Contractual Clauses for GDPR-compliant transfers. For details, see Google's Data Processing Terms.

Newsletter and checklist data is processed by MailerLite, a company based in the European Union. Where MailerLite uses sub-processors outside the EU, transfers are covered by Standard Contractual Clauses under MailerLite's Data Processing Agreement.

10. Changes to This Policy

I may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the website after changes constitutes acceptance of the revised policy.

11. Contact

If you have any questions about this Privacy Policy or how your data is handled, please contact me at contact@greenblueorangeconsulting.com or by post at the address above.