1. Controller
2. Hosting
This website is hosted by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA). When the site is accessed, Vercel processes technically necessary server log data (including IP address, timestamp, requested file) to deliver the site securely and reliably. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). On the transfer to the US, see section 6.
3. Appointment booking (Google Calendar)
To book consultation slots we embed Google Calendar appointment scheduling (Google Ireland Limited, Ireland). When you use the booking widget, the data you enter (name, email, chosen slot) is transmitted to Google to confirm the appointment. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures / performance).
4. Contact & audit request
When you use the request form or the contact channels (email, WhatsApp, phone), we process the information you submit solely to handle your request (Art. 6(1)(b) and (f) GDPR). Form requests are delivered to us by email; any form-delivery provider will be named here once activated.
5. Future services (only after consent)
Once reach and conversion measurement is activated (Google Tag Manager, Google Ads conversion tracking and remarketing by Google Ireland Limited) or HubSpot (HubSpot, Inc., USA) is embedded for forms and CRM, this happens only after your active consent (Art. 6(1)(a) GDPR) via an upstream consent banner. Until then, no non-essential tags are loaded.
6. Data transfer to the US
Some of the services used transfer data to the US (Art. 44 ff. GDPR). Transfers are based on Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework. As the controller is itself a US LLC, particular diligence obligations apply here.
7. Your rights
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection (Art. 21 GDPR) and withdrawal of consent given
- Complaint to a supervisory authority (Art. 77 GDPR)
Retention: data is deleted as soon as the purpose of processing no longer applies and no statutory retention periods prevent it.