Privacy Policy

This policy explains which personal data this site processes, why, and for how long, as required by Art. 13 of the General Data Protection Regulation (GDPR). Last updated: 13 September 2026.

What this site does not do

• It sets no cookies and stores nothing in your browser.
• It loads no fonts, scripts or images from third parties.
• It builds no user profiles and does not recognise you on a later visit.
• Your name, company, role and email are collected only if you send the form.

1. Visiting the site (server logs)

The site runs on Cloudflare Workers. When you open a page, Cloudflare processes the connection data that is technically necessary to deliver it: your IP address, date and time, the address requested and your browser's user agent. Purpose: delivering the site and keeping it secure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working site).

Storage period: the request and error logs of the application are deleted automatically after 7 days at the latest (Cloudflare Workers Logs). We keep no other logs and do not analyse these logs to identify anyone.

2. The form “Request a conversation”

When you send the form, we process: your name, company, role, email address, the segment and the number of claims per year you chose, the time of your consent and its wording, and — if the link you followed contained them — the campaign parameters utm_source, utm_medium and utm_campaign. We note whether the email address belongs to a public mail provider.

• Purpose: to arrange and hold the 20-minute research call you asked for, and to send you the anonymised results we promised.
• Legal basis: your consent, Art. 6(1)(a) GDPR, given with the checkbox. You can withdraw it at any time by email to the address above (Art. 7(3) GDPR); this does not affect the lawfulness of processing before the withdrawal.
• Where it is stored: in a Cloudflare D1 database created with the EU jurisdiction, which means Cloudflare runs and stores that database only inside the European Union.
• Notification: the operator receives your details by email (sent via Brevo, see below) so that he can reply to you directly. The mailbox is hosted by Google (Gmail).
• Storage period: until you ask us to delete your details, and automatically 12 months after your request at the latest. After deletion only the segment, the number of claims per year and the campaign parameters remain, which do not identify you.
• Voluntary: providing the data is neither legally nor contractually required. Without name, company, role, email address and consent we cannot arrange the call.

3. Usage statistics (PostHog)

To see whether the page reaches the people we write to, we count page views and five actions: opening the page, scrolling to half of it, starting to fill in the form, sending it, and clicking a source link. Each event carries the campaign parameters of the link you followed, and for a sent form the chosen segment and number of claims per year — never your name, company, role or email address.

• How: PostHog's script is served from this site; the events are sent to PostHog's EU cloud (eu.i.posthog.com, hosted in Frankfurt). PostHog runs here in “cookieless” mode: no cookies, nothing stored in your browser, no persistent identifier. To count unique visitors, PostHog computes a hash of your IP address and browser details on its servers; no user profile is created. Autocapture, session recording, surveys and feature flags are switched off.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in knowing whether the research invitation is read). You can object at any time (Art. 21 GDPR), for example by blocking the script in your browser; the page and the form work without it.
• Storage period: PostHog keeps event data for the retention period of the plan used, currently one year.

Recipients

• Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA — hosting, the database and delivery of the site. For transfers from the EEA to the USA Cloudflare states that it relies on its certification under the EU-U.S. Data Privacy Framework and additionally on the EU Standard Contractual Clauses.
• Sendinblue (brand “Brevo”), a French simplified joint-stock company, 9-17 rue Salneuve, 75017 Paris, France, registered with the Paris Trade and Companies Register under number 498 019 298 — sending the notification email with your details. Brevo uses sub-processors that may process data outside the EEA, including in the USA, Canada, Serbia and India; depending on the recipient, the basis is the EU Standard Contractual Clauses, the EU-U.S. Data Privacy Framework or an adequacy decision of the European Commission. Brevo deletes or anonymises the data at the latest 100 days after the end of the contract.
• Google — provider of the operator's mailbox (Gmail) that receives the notification email, under Google's own terms. Google states that for transfers of personal data from the EEA to the USA it relies on the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses.
• PostHog Inc., USA — usage statistics, processed in PostHog Cloud EU, which PostHog hosts in the AWS region eu-central-1 in Frankfurt, Germany.

Cloudflare, Brevo and PostHog process the data as processors on behalf of the controller (Art. 28 GDPR). We do not sell your data and do not pass it on to anyone else.

No automated decisions

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. A person reads your request and replies.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on Art. 6(1)(f) (Art. 21). Write to the email address above; we answer within one month.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence or place of work.

Back to the start page · Impressum