1. Controller
2. Hosting
[Add provider] — add server location, data-processing agreement and purpose.
3. Cookie consent tool
[Add provider] — consent is required before Google Tag Manager starts. All non-essential tags load only after active consent (Consent Mode).
4. Google Tag Manager, Google Ads conversion tracking & remarketing
We use Google Tag Manager to manage tags, as well as Google Ads conversion tracking and remarketing. These services run only after consent has been given pursuant to Art. 6(1)(a) GDPR. Provider: Google Ireland Limited.
5. HubSpot (forms, CRM, tracking)
For contact forms, meeting booking and our CRM we use HubSpot (HubSpot, Inc., USA). When you use the forms or the meetings calendar, the data entered is transmitted to and processed by HubSpot. Note on third-country transfer to the US (see section 7).
6. Brevo Meetings / calendar embed
[If used: add provider, purpose and legal basis.]
7. Data transfer to the US
Some of the services used transfer data to the US (Art. 44 ff. GDPR). Transfers are based on Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework. As the controller is itself a US LLC, particular care is required here — this section must be clarified with a lawyer.
8. Your rights
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection (Art. 21 GDPR) and withdrawal of consent given
- Complaint to a supervisory authority (Art. 77 GDPR)
Retention: data is deleted as soon as the purpose of processing no longer applies and no statutory retention periods prevent it.