Privacy
Policy.
How we handle personal information when you use our website, contact our firm, request resources, or engage our professional services.
Last updated: 25 October 2026 · Website: drapal.ski
Who we are.
This policy describes processing by Drapalski Consulting LLC, a Wyoming limited liability company with an operating business office in Germany. For the website and its own business administration, the company acts as the controller where it determines the purposes and means of processing. Roles for particular client engagements may differ and are assessed separately.
German operating office
Reckenberger Straße 533332 Gütersloh
Germany
U.S. mailing address
Drapalski Consulting LLC2232 Dell Range Blvd
Suite 303 #1067
Cheyenne, WY 82009
United States
Privacy contact: Ross A. Drapalski, compliance@drapal.ski. This is a privacy contact and should not be interpreted as a statement that a statutory Data Protection Officer has been appointed.
This website and our operations may be subject to EU/German data protection laws and, depending on the activity and individuals concerned, applicable U.S. or other privacy and professional confidentiality requirements. We assess relevant obligations by processing activity; incorporation in the United States does not, by itself, exclude GDPR obligations.
Information we handle.
The categories depend on how you interact with us. We seek to collect information reasonably necessary for the relevant purpose.
Information you provide
Name; business or organization; job role; contact information; messages and correspondence; requests for resources; and information or documents supplied for an inquiry or engagement.
Website and technical data
IP address, access date/time, requested URL, browser and device data, referring page, server/security logs, and—where applicable—cookie identifiers and usage events.
Where a comments function, newsletter form, or download registration is offered, the information entered into that feature may also be processed. Business contacts or referrals may come from publicly accessible business sources or professional partners; where Article 14 GDPR applies, we provide the required information subject to statutory exceptions.
Confidential client information is different from ordinary website data. Tax, accounting, ownership, financial, identification and dependent-related records may require additional safeguards and U.S. tax-preparer confidentiality rules. Please do not send Social Security numbers, full tax returns, identity documents or bank credentials through an ordinary website inquiry or unprotected email.
Why we process data.
Where the GDPR applies, we identify a legal basis for each activity. The appropriate basis depends on the circumstances and the person whose information is processed.
Where information is necessary for an inquiry or an engagement, failure to provide it may prevent us from answering or performing the requested work. Providing information for optional marketing or non-essential tracking is voluntary.
Hosting, analytics & cookies.
WordPress and website hosting
Our website operates on WordPress and is hosted using Hostinger services. Hosting and security functions can process technical connection data, IP addresses and access logs to deliver pages, keep the service operational, and investigate misuse. Hostinger-related website features may also process limited visitor information depending on which services are enabled.
Google Analytics 4
Our website contains a Google Analytics tag with measurement ID G-RFW5CW1BJG. Google Analytics can measure page views, visitor interactions, approximate location, device and browser characteristics, and related identifiers. Google may receive information in connection with these functions. Analytics processing and storage are subject to Google’s service settings, the relevant contractual terms, and required consent arrangements.
For more information, see Google’s privacy policy. Non-essential analytics and similar storage/access technologies require an appropriate consent mechanism where required by § 25 TDDDG and the GDPR. Consent must be obtainable and withdrawable through a functioning site configuration; this page itself is not a consent banner.
Fonts and third-party content
This website uses typefaces supplied by Google Fonts. Depending on the active font configuration, a visitor’s browser may connect to Google servers to retrieve these assets, transmitting technical connection information such as the visitor’s IP address. Embedded videos, scheduling interfaces or other third-party services may introduce additional processing where installed and activated on particular pages.
Automatic translation — TranslatePress and Google Cloud Translation API
We use the WordPress plugin TranslatePress and the Google Cloud Translation API to offer translations of publicly available website content into additional languages. When automatic translation is required, relevant text strings may be transmitted to Google for translation processing. TranslatePress generally stores the resulting translations in the website’s WordPress database so they can be reused without submitting the same unchanged strings again.
The translation function is intended for public website content, not for the submission of confidential client files, tax records or other sensitive documents. Automatic translations may contain inaccuracies. The English-language original is available for clarification; this does not limit your statutory rights. For details about Google processing, see Google’s Privacy Policy and Google Cloud Translation data-use information.
Cookies and browser controls
Technical cookies may be needed for security, session management or explicit user preferences. Analytics, personalization and marketing technologies that are not strictly necessary are subject to applicable consent requirements. You can also restrict cookies using browser settings, although this may affect certain functions. For information about cookie choices on this website, contact compliance@drapal.ski.
Important distinction: a description of cookies does not itself obtain consent. We aim to ensure any active non-essential tracking is configured in accordance with the choices made by visitors.
Inquiries, resources & services.
Contact and email
If you email us or submit an inquiry, we use the supplied details to read and respond to the request, record relevant correspondence, and take requested steps concerning a potential engagement. Business communications may be processed through Microsoft 365 email and file services where used for the specific relationship.
Downloads and newsletters
When a download is offered without registration, a separate marketing subscription is not implied by the download. If a resource requires your details, we use them to deliver it and explain any additional use at collection. Promotional email is governed by applicable marketing rules and, where consent is required, may be declined or unsubscribed from.
Engagement records
If we provide professional services, the relevant engagement letter and any separate client or tax data notice may provide additional details about information collected, disclosure limitations, retention, professional obligations and secure exchange. This website notice does not replace those engagement-specific disclosures.
Recipients & international transfers.
Service providers and recipients
Personal data may be received by providers needed to operate the website and communicate with clients, including Hostinger (web hosting), Google (website analytics, externally loaded fonts and Cloud Translation API), Microsoft (business email and collaboration where used), and relevant professional service providers. Independent professional advisers, counterparties or authorities receive information only where an appropriate lawful or contractual basis applies.
Some recipients act as processors on our behalf; others may act as independent controllers for specified activities. Where Article 28 GDPR requires a data processing agreement, appropriate contractual terms must be in place. We do not treat every service provider as a processor merely because its services are used.
International operations
Because our business is a U.S. LLC operating from Germany, personal information may involve the European Economic Area, the United States, and other locations relevant to specific services or service providers. Storage in one country does not exclude access or processing from another. We assess applicable Chapter V GDPR transfer requirements and rely, where appropriate, on applicable adequacy decisions, valid Standard Contractual Clauses, or another recognized lawful mechanism.
You may contact us to request information about the applicable safeguards for transfers affecting your data, subject to lawful confidentiality and security restrictions.
We do not sell personal information for monetary consideration. If any advertising or measurement features are changed in the future, we will reassess related disclosure and consent obligations.
How long data is retained.
We retain information only for a purpose supported by an applicable legal basis and review it for deletion, restriction, or lawful archiving when it is no longer needed. Periods depend on category, purpose, local retention rules, litigation holds, and applicable U.S. tax-preparer or other professional requirements; one universal retention term does not apply to every record.
Your rights & choices.
Where the GDPR applies, and subject to its conditions and exceptions, you may have rights to access information about processing (Article 15), rectify inaccurate data (Article 16), erase data (Article 17), restrict processing (Article 18), receive data in a portable format (Article 20), object to particular processing including direct marketing (Article 21), and withdraw consent with effect for the future (Article 7(3)). Article 22 may also apply to certain solely automated decisions. We do not use solely automated decision-making that produces legal or similarly significant effects as part of our ordinary website operations.
Send a request to compliance@drapal.ski. We may seek proportionate verification where necessary. For applicable GDPR requests, we ordinarily respond within one month and will notify you of any lawful extension and its reasons.
Complaints: You may complain to a competent supervisory authority, including the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany. You may also contact the authority in the EU Member State of your habitual residence, work, or the alleged infringement, as applicable.
Residents of U.S. states and other jurisdictions may have additional statutory privacy rights where the relevant laws apply to our activities. We consider such requests according to the applicable law; this statement does not presume that every state privacy law or threshold applies to our business.
Security & confidentiality.
We use and review technical and organizational safeguards appropriate to the risks posed by the information, including access controls, secure information exchange, confidentiality restrictions and incident handling. We use two-factor or multi-factor authentication (2FA/MFA) for administrative and business-service accounts where supported and enabled, including applicable hosting or service-provider accounts. Availability and configuration of these protections can vary by system; their use should not be understood as a guarantee that every account or service has MFA. Access permissions and other safeguards are adapted to the data, service and provider involved. No internet-based system can be guaranteed absolutely secure.
Our internal security policies and partner-specific data protection agreements are not substitutes for this public-facing website privacy notice. Their draft contents should not be interpreted as certification that a particular control or processing location is implemented or guaranteed.
If you suspect a privacy or security incident involving information supplied to us, contact compliance@drapal.ski. Avoid including unnecessary sensitive information in the initial email.
Other considerations.
Children and dependents
This website is directed to adults and professional users, not children. In a professional engagement, however, client-provided records may legitimately include information about children or dependents and receive appropriate confidentiality and privacy protections.
Social media and external links
We may operate professional pages on platforms such as LinkedIn. A platform and Drapalski Consulting may each process interaction data for their own purposes, depending on the service and applicable arrangements. Please refer to the platform’s privacy notice for its processing. External website links lead to services governed by their own disclosures.
Updates and language
We may revise this policy when our processes, providers or legal obligations change. The updated version will be published on this page with a revised date. Translations may be generated automatically through TranslatePress and Google Cloud Translation. They may contain inaccuracies; the English-language original is available for clarification. Applicable legal rights are not reduced by differences in translation.
This policy describes general website and business processing. Matters concerning individual engagements and specially regulated U.S. tax-return information may also be governed by more specific notices, engagement terms and law.