Privacy Policy

This page is an internal demo build and not yet publicly promoted — the link is shared only with a very small, known group of people. The following describes the actual state of data processing on this site today; individual details (marked in square brackets) are placeholders and will be completed, or confirmed by legal review, before public launch. The German version of this page is the legally authoritative one.

1. Controller

The controller under the General Data Protection Regulation (GDPR) is:
GROUNDUP Holding GmbH
Talstraße 34
66424 Homburg
Germany
Email: [email address] — placeholder, to be added.
Further details in the Imprint.

2. Data Protection Officer

No data protection officer has been appointed at this time [placeholder — depends on company size and review of the statutory appointment requirement under Art. 37 GDPR / § 38 BDSG].

3. General Information on Data Processing

We only process personal data to the extent necessary to provide this site and its content and functions. Processing regularly takes place only with consent (Art. 6(1)(a) GDPR), to perform a contract or pre-contractual measures (Art. 6(1)(b) GDPR), or on the basis of legitimate interests (Art. 6(1)(f) GDPR).

4. Hosting and Server Log Files

This site is hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA, USA; for EU visitors, data processing outside the EU/EEA is, where applicable, safeguarded via Standard Contractual Clauses). When you visit the site, the hosting provider automatically collects technical access data (including IP address, date and time of access, page accessed, browser used) that is necessary for the technical delivery and security of the site (Art. 6(1)(f) GDPR, legitimate interest in secure and stable operation).

5. Local Storage (Theme, Language, Cookie Setting)

This site uses localStorage (not classic cookies) in your browser to remember three purely technical settings: your chosen light/dark display, your chosen language version, and the choice you made in the cookie notice. This data never leaves your browser, contains no personal data, and is never evaluated for analytics or marketing purposes. The legal basis is our legitimate interest in a functioning, repeatably usable presentation of the site (Art. 6(1)(f) GDPR); since these are technically necessary functions, no separate consent under § 25(2) TTDSG is required.

6. Google Analytics

If you selected "Accept all" in the cookie notice, we use Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA), a web analytics service that helps us understand how visitors use this site (e.g. pages viewed, time spent, device type). This sets cookies and transmits pseudonymous usage data to Google's servers, including in the US. Google Analytics 4 does not store full IP addresses.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG). The transfer to the US is based on the EU Standard Contractual Clauses with Google. You can withdraw your consent at any time, with effect for the future, via the cookie settings button (bottom right); without your consent, Google Analytics is not loaded.

More information: Google's privacy policy.

7. Fonts

This site uses the typefaces "Inter" and "JetBrains Mono". Both are self-hosted and served from our own server, not loaded from Google or any other third party. As a result, no IP address or other data is transmitted to a third party for this purpose.

8. Owner Analysis Form

If you fill out and submit the Owner Analysis, we process the information you enter (name, email address, company, phone, your answers to the questionnaire, and an optional preferred appointment time) to process your request and arrange an initial conversation. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measure taken at your request) or, for email appointment confirmation, Art. 6(1)(a) GDPR (consent).

The data is stored in a database hosted by Supabase (hosting region Frankfurt am Main, Germany). It is not passed on to further third parties, except for an optional email sent to notify our team internally about a new request.

Your data is deleted once it's no longer needed to process your request, but no later than [retention period, e.g. 24 months without further contact] — placeholder, to be added, unless statutory retention obligations require otherwise.

9. Contact Form

If you fill out and submit the contact form, we process the information you enter (name, email address, your message) to process and respond to your request. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measure taken at your request) or Art. 6(1)(f) GDPR (legitimate interest in responding to incoming inquiries).

The data is stored in a database hosted by Supabase (hosting region Frankfurt am Main, Germany). It is not passed on to further third parties, except for an optional email sent to notify our team internally about a new request.

Your data is deleted once it's no longer needed to process your request, but no later than [retention period, e.g. 24 months without further contact] — placeholder, to be added, unless statutory retention obligations require otherwise.

10. Recipients and Processors

Cloudflare, Inc. — hosting and delivery of the site.
Supabase Inc. — database for the Owner Analysis and the contact form (hosting region Frankfurt).
Resend — optional email delivery to notify our team internally about new form submissions (Owner Analysis, contact form).
Google Ireland Limited / Google LLC — Google Analytics, only with your consent (see item 6).

Data processing agreements under Art. 28 GDPR are in place, or will be put in place, with all processors [placeholder — to be confirmed before public launch].

11. Your Rights

Under applicable law, you have the right at any time to:

Access the personal data we hold about you (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure of your data held by us (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Object to processing (Art. 21 GDPR)
Withdraw any consent given, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, contact us at the address given under item 1 above.

12. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. The competent authority is generally the one at our company's registered seat:

Unabhängiges Datenschutzzentrum Saarland (UDZ)
Fritz-Dobisch-Straße 12
66111 Saarbrücken
Germany

13. Currency and Changes to This Policy

This privacy policy is currently in effect. As the site evolves or legal requirements change, it may need to be updated. Last updated: [date] — placeholder, to be added on publication.