Privacy policy

1. Who is the controller?

The controller under Article 4(7) GDPR is:

No data protection officer has been appointed. There is no obligation to do so under section 38 of the German Federal Data Protection Act, because fewer than 20 people are permanently engaged in automated processing of personal data.

2. What happens when you open a page?

Your browser transmits technically necessary data to the hosting provider's server, which stores it in server log files: the address requested, date and time, volume transferred, a success message, browser type and version, operating system, the referring page and the IP address.

The legal basis is Article 6(1)(f) GDPR; the legitimate interest lies in technically faultless operation and defence against attacks. This data is not merged with other sources and not used to build usage profiles.

Hosting provider

This website is served through Cloudflare Pages, provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare processes the data above as a processor under a contract pursuant to Article 28 GDPR including the European Commission's standard contractual clauses. Requests are usually answered from the nearest data centre, which for visitors from Germany is normally a location inside the European Union; processing in the United States cannot be ruled out. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision under Article 45 GDPR on 10 July 2023.

To detect automated access, Cloudflare may set the cookie __cf_bm with a lifetime of 30 minutes. It serves solely to fend off abusive access, contains no identifier for recognising individuals, and is therefore strictly necessary under section 25(2) no. 2 of the German TDDDG.

3. What happens to contact form entries?

The contact form collects your name, email address, a description of your enquiry and a budget range as required fields, plus company and how you found this site as optional fields.

The legal basis is Article 6(1)(b) GDPR where the enquiry relates to entering into or performing a contract, otherwise Article 6(1)(f) GDPR with the legitimate interest in answering enquiries. The details are used solely to answer the enquiry, are not passed to third parties, and are deleted once the matter is closed unless statutory retention periods apply — generally six years under section 257 of the German Commercial Code or ten years under section 147 of the German Fiscal Code for contract-related correspondence.

To guard against automated submissions the form contains a field invisible to humans and measures the time between page load and submission. Neither method involves an external service; in particular, no reCAPTCHA is used.

Sending the emails

Brevo, a service of Brevo SAS based in France, is used to send the enquiry and the automatic confirmation. The details you enter in the form and your email address are transmitted. Processing takes place on servers inside the European Union under a contract pursuant to Article 28 GDPR. Incoming mail to kontakt@vantage-growth.org is handled by Cloudflare Email Routing, the same provider that hosts this site (see section 2).

4. Are cookies set?

No cookies are set for analytics, marketing or profiling. At the last measurement of the delivered pages, 0 cookies were set. This does not affect the hosting provider's anti-abuse cookie described in section 2.

One single cookie is set, and only once you actively use the language switch in the header: vgp_sprache stores your chosen language for one year. It contains only the value "de" or "en", no identifier and no personal reference. It is strictly necessary for the function you expressly requested and therefore exempt from consent under section 25(2) no. 2 of the German TDDDG. There is no automatic redirect based on browser language or IP address.

5. Is anything loaded from third-party servers?

No. Fonts, images, stylesheets and scripts are served exclusively from this site's own server. No Google Fonts, no map services, no video platforms, no review widgets and no social buttons are embedded, so your IP address is not transmitted to any third party. This property is verified automatically on every change: a test run loads every page in a browser and fails as soon as a request goes out to a third-party domain.

6. Is there any analytics?

Not at present. No analytics tool is embedded — neither Google Analytics nor Matomo nor a comparable service. Only the server log files described in section 2 are evaluated. Should analytics be introduced, this policy will be amended beforehand.

7. What are your rights?

• Access to the data processed, Article 15 GDPR
• Rectification of inaccurate data, Article 16 GDPR
• Erasure, Article 17 GDPR, unless a retention obligation applies
• Restriction of processing, Article 18 GDPR
• Data portability, Article 20 GDPR
• Objection to processing based on Article 6(1)(f) GDPR, Article 21 GDPR

An informal message to kontakt@vantage-growth.org is sufficient to exercise any of these rights.

8. Where can you complain?

Under Article 77 GDPR you have the right to lodge a complaint with a supervisory authority. The authority responsible for the controller's location is:

9. Is there automated decision-making?

No. There is no automated decision-making, including profiling, within the meaning of Article 22 GDPR.