Skip to content

Privacy Policy

Revised

1. Controller

The controller for the processing of personal data on this website is:


Michael Berezovsky


Von-der-Pfordten-Str. 27


80687 München


Germany


Email: michael.berezovsky@spontaction.com

2. Data protection officer

We have not appointed a data protection officer. We are not required to: fewer than 20 people are constantly engaged in the automated processing of personal data here, and we carry out no processing that would trigger an appointment under Art. 37 GDPR or § 38 BDSG. For any privacy question, reach us at the address above.

3. Visiting this website

For your browser to display a page, our server and the reverse proxy in front of it must technically process your IP address together with details of the request: time, address requested, browser and operating system identifier, and volume of data transferred. Our application does not store this and builds no profiles from it. Short-lived log files may be produced at server and proxy level to keep the site running and to fend off attacks.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and functioning operation of this website.

Retention: short-lived log files are deleted automatically after a few days; any other data is not stored.

4. Fonts

This website loads the typeface “Bricolage Grotesque” directly from Google’s servers (fonts.googleapis.com and fonts.gstatic.com) on every page view. Your browser connects to Google to do so and transmits your IP address in the process. This currently happens regardless of your cookie choice, because a typeface is a styling resource rather than a cookie. The second typeface we use (“Geist”) is served from our own server and triggers no third-party connection.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Transmission to Google LLC in the United States cannot be ruled out.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a consistent and quickly delivered presentation of the website.

5. Contact form

Through our contact form we process what you enter there: your name, your email address, and your message. A hidden field serves spam protection only and is never filled in by a person. Your entries are not written to a database; they are delivered to our mailbox as an email. We set your address as the reply-to address so we can answer you directly.

Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns a contract or steps prior to one, otherwise Art. 6(1)(f) GDPR based on our legitimate interest in answering enquiries.

Retention: until your enquiry has been dealt with. We then delete the correspondence unless commercial or tax law requires us to keep it.

6. Waitlist

If you join our waitlist, we process your email address and nothing else. It is not written to a database either; it is delivered to our mailbox as an email. We use it solely to notify you once Spontaction launches.

Legal basis: Art. 6(1)(a) GDPR. You can withdraw your consent at any time without any formality, for instance by emailing the address above. The lawfulness of processing carried out before the withdrawal is unaffected.

Retention: until launch or until you withdraw, whichever comes first.

7. Appointment booking via Cal.com

On our booking page we embed the Cal.com calendar. It only loads after you have accepted the “Embedded content” category in the cookie banner. Before that you see a placeholder and no connection to Cal.com is made.

Once the calendar loads, Cal.com sets its own cookies and processes your IP address along with whatever you enter in the booking form, usually your name, your email address, and the slot you pick. That data goes to Cal.com directly, not through our servers. We receive the booking confirmation from Cal.com.

The provider is Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. Details are in their privacy policy at cal.com/privacy.

Legal basis: Art. 6(1)(a) GDPR (consent given via the cookie banner) and, for the appointment itself, Art. 6(1)(b) GDPR.

8. Audience measurement with Google Analytics

If you accept the “Analytics” category in the cookie banner, we use Google Analytics 4. Only then does your browser load the script from googletagmanager.com, and only then are measurement cookies set. If you decline or make no choice, nothing is loaded and nothing is measured.

Google Analytics records the pages you open, the time and duration of your visit, an approximate location, the referring page, and browser and device characteristics. We have IP anonymisation switched on, so your IP address is truncated before any further processing. We use Google Analytics for audience measurement only, not for advertising and not for cross-device tracking.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data is transferred to Google LLC in the United States.

Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.

Retention: Google’s analytics cookies expire after two years at the latest. In Google Analytics, event data is retained for 2 months and user data for 14 months.

Without your consent this website sets exactly one cookie, the one belonging to the consent manager. It records which categories you allowed so we do not have to ask again on every visit. It sits on our own domain, carries no identifier that would let us recognise you, and expires after roughly six months. Legal basis: § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.

Every other cookie belongs to the “Analytics” or “Embedded content” category and is only set after you have explicitly agreed.

How to change your choice: at the very bottom of every page, the footer carries a “Cookie Settings” button. It opens the same window you saw on your first visit. There you can switch each category on or off individually and withdraw your consent with immediate effect for the future. If you withdraw analytics consent, the page reloads so that no measurement script stays active. You can also delete cookies at any time in your browser settings.

10. Recipients and processors

We do not pass your data to third parties for resale or advertising. To run this website we do use service providers who act on our behalf and on our instructions. Data processing agreements under Art. 28 GDPR are in place with them:

  • Hosting: the website, the CMS, and the database run in our own containerised environment on a rented server. Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany
  • Object storage: images from our editorial system and encrypted database backups are stored in Hetzner Object Storage, operated by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, in the Nuremberg data centre.
  • Email delivery: messages from the contact form and the waitlist are sent via Resend, operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA.
  • Appointment booking: Cal.com, Inc., USA, only after your consent (see section 7).
  • Audience measurement: Google Ireland Limited, Ireland, only after your consent (see section 8).

11. Transfers to third countries

Resend, Cal.com, and Google also process data in the United States. For the US, the European Commission has issued an adequacy decision under Art. 45 GDPR in the form of the EU-US Data Privacy Framework; it applies to companies certified under it. The operator of Resend is certified under that framework. Where a recipient is not certified, we base the transfer on the European Commission’s standard contractual clauses under Art. 46(2)(c) GDPR. Even so, a level of protection equivalent in every respect to European law cannot be guaranteed against access by US authorities. If you want to avoid this, decline the relevant cookie categories and email us directly instead.

Google is certified under the EU-US DPF; for Cal.com we rely on Standard Contractual Clauses.

12. Do you have to provide your data?

No. You are under no legal or contractual obligation to give us personal data. Without it, though, we cannot get in touch: with no email address we cannot answer your enquiry or tell you when we launch. No disadvantage arises for you beyond that.

13. No automated decision-making

No automated decision-making within the meaning of Art. 22 GDPR takes place on this website, and we carry out no profiling here.

14. Your rights

You have the following rights towards us:

  • Access to the data we hold about you (Art. 15 GDPR)
  • Correction of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to certain processing (Art. 21 GDPR, see section 15)
  • Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise them, write to info@spontaction.com. We reply within one month.

15. Right to object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out on the basis of Art. 6(1)(f) GDPR. On this website that covers the processing described in sections 3 and 4. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise, or defend legal claims.

If your data is processed for direct marketing, you can object at any time without giving reasons. Your data will then no longer be used for that purpose.

16. Complaint to a supervisory authority

You can lodge a complaint with a data protection supervisory authority at any time, in particular in the member state of your residence, your place of work, or the alleged infringement. The authority competent for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
www.lda.bayern.de

17. Security

Traffic between your browser and our servers is encrypted end to end with TLS; you can see this from the padlock in the address bar. Our database is not reachable from the outside, backups are stored encrypted, and access to systems and mailboxes is limited to the people who need it for their work. No transmission over the internet can offer absolute protection.

18. Changes to this privacy policy

We update this policy when our website, the services we use, or the legal situation change. The version published here is the one that applies; the date of the last revision appears at the top of this page.