1. Controller
The controller responsible for processing personal data on this website is Brandsetters (see Imprint for provider details and contact information).
2. Data we collect
Contact form submissions: name, email, company, budget, area of interest and message content. Server logs: IP address, user agent, timestamp, referrer (kept 14 days for security and anti-abuse). Analytics: aggregated, cookie-less page views via our own privacy-first analytics.
3. Purpose and legal basis
Contact form: Art. 6 (1)(b) GDPR (steps prior to entering a contract) and Art. 6 (1)(f) GDPR (legitimate interest in responding to inquiries). Server logs: Art. 6 (1)(f) GDPR (legitimate interest in IT security). Analytics: Art. 6 (1)(f) GDPR (legitimate interest in understanding site usage without tracking individuals).
4. Retention
Contact form data is retained for up to 24 months from your last interaction, or until you request deletion. Server logs are rotated every 14 days. Analytics data is aggregated and never linked to identifiable users.
5. Recipients and processors
Hosting: Dokploy / Hetzner Cloud (EU). Email: our business email provider on EU infrastructure. Analytics: self-hosted. We only work with processors bound by a data processing agreement (DPA) per Art. 28 GDPR.
6. International transfers
Data is processed within the EU. When we engage any US-based sub-processor, we rely on EU Standard Contractual Clauses (SCCs) and additional safeguards per Schrems II.
7. Your rights
Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and objection. You also have the right to lodge a complaint with a supervisory authority.
8. Cookies
This site does not use tracking cookies. Strictly necessary cookies are used only for locale preference and form session state.
9. Contact for data requests
Please email [email protected] for any data-related request. We respond within 30 days, free of charge.