Privacy policy

1. Controller

The controller responsible for processing personal data on this website is:
DropDigital GmbH
Amtsgericht Düsseldorf, HRB 114360
An der Pönt 44, 40885 Ratingen, Germany
Represented by the managing directors Lucas Koch and Can Tillmann
Email: lucas@dropdigital.de
Telephone: +49 163 302 2575

We have not appointed a data protection officer because the statutory requirements do not apply (section 38 BDSG, Art. 37 GDPR). For any questions about data protection, contact us at lucas@dropdigital.de.

Brand / project: DropD. (Dropdigital), see Legal notice.

2. Key points

• This website does not load analytics, advertising or media services before you give your consent. No script from Google, Microsoft or Meta is loaded without your consent.
• Our servers are in Germany. We use US services for email delivery, bot protection, appointment booking, chat and, only with consent, analytics and advertising. Section 16 lists these services.
• We do not sell data, carry out profiling or make automated decisions with legal effects.
• You can withdraw any consent at any time and object to processing based on legitimate interests (section 19).

3. Hosting, server logs and security

This website runs on servers operated by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. We have a data processing agreement with Hetzner under Art. 28 GDPR. Data processed for this purpose stays within the European Union.

Whenever you visit, the server automatically processes your IP address, the date and time, the page requested, the amount of data transferred, the status code, the previously visited page (referrer), and your browser and operating system. This supports secure and stable operation, protection against attacks and error analysis. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is in operating the website for these purposes. Logs are deleted within 30 days and are not combined with other data.

To prevent abuse, we limit the number of requests to our forms and interfaces per IP address. The counter is held only in memory, is not stored permanently and expires within 24 hours.

All transmission is TLS-encrypted (HTTPS with HSTS). We serve fonts from our own server; no fonts are loaded from Google Fonts.

4. Cookies and local storage on your device

Without your consent, we store on your device only what is strictly necessary for the service you have requested (section 25(2), no. 2 TDDDG):

We use analytics and external media only with your consent (section 25(1) TDDDG, Art. 6(1)(a) GDPR). Google Analytics 4 sets _ga and _ga_XYNK1V7477, each with a lifetime of 2 years, or 400 days in Chrome. Microsoft Clarity sets _clck for 365 days and _clsk for 1 day. When you withdraw your consent, we delete these cookies on our domain. We cannot delete cookies on domains belonging to Google or Microsoft.

5. Consent, withdrawal and records

On your first visit, our banner asks separately for consent to external media and analytics. Marketing is offered only when a corresponding service is configured. Rejecting is available at the same level as accepting, and nothing is preselected. You can change or withdraw your choices at any time through the “Cookie settings” link in the footer, with effect for the future (Art. 7(3) GDPR). After withdrawal, we stop the affected services and delete their cookies on our domain.

To demonstrate your consent under Art. 7(1) GDPR, we record each decision with its time, the purposes selected, the version of this policy and the random identifier described in section 4. We store no IP address or browser identifier with this record. The legal basis is Art. 6(1)(c) GDPR (the duty to demonstrate consent). The record is kept for three years from each decision.

6. Analytics and advertising measurement (only with consent)

Analytics: With your consent, we use Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) and Microsoft Clarity (Microsoft Ireland Operations Ltd., One Microsoft Place, Dublin 18, Ireland) to measure which pages are read, how far visitors scroll and where they leave. Data is processed pseudonymously. Clarity captures mouse movements, clicks and scrolling to create session recordings and heatmaps. Both providers may transfer data to the US (Google LLC, Microsoft Corporation), see section 17.

Advertising measurement: If Meta Pixel or Google Ads is configured and you consent to marketing, we tell Meta (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland) or Google Ads (Google Ireland Ltd.) whether an enquiry resulted from one of our advertisements. The providers may use this information to create audiences and transfer data to the US.

Technical implementation and Consent Mode: We load Google Analytics 4 directly through gtag.js from googletagmanager.com. We load Microsoft Clarity directly from clarity.ms. We do not use a Google Tag Manager container for these services. Both services load only after you consent to analytics. We use Google Consent Mode v2 in basic mode. Before consent and after withdrawal, we send no cookieless analytics signals to Google. Advertising cookies are always blocked for Clarity.

The legal basis in each case is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG). These services are active only if we have configured them for the website; they are never loaded without consent.

7. External media (YouTube)

In the “Knowledge” section, we embed YouTube videos in privacy-enhanced mode (youtube-nocookie.com, Google Ireland Ltd.). A video loads only after you consent to the “External media” category or click “Load video”. Only then does YouTube receive your IP address and set its own cookies; data may be transferred to the US (Google LLC). The legal basis is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG).

8. Bot protection (Cloudflare Turnstile)

Our forms and chat are protected against automated input by Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, US). The script loads only when you open a form, select a form field or submit a form. During the check, Cloudflare processes your IP address and technical browser characteristics and may set a technically necessary token; you generally do not need to solve a puzzle. The legal basis is section 25(2), no. 2 TDDDG, because the check is necessary for the form submission you requested, and Art. 6(1)(f) GDPR (prevention of spam and abuse). We have a data processing agreement with Cloudflare; transfers to the US are safeguarded as described in section 17.

9. Enquiries through our forms

Depending on the form, we process the data you provide:

• Strategy call (/beratung and /termin): You choose an available time on this website. We process your name, email address, company and chosen appointment, create the event in our Google Calendar and send an invitation with a Google Meet link. The package cards use the same calendar. /vor-ort remains a form: name, email address, company, team size, optional telephone number, message and your business location.
• Callback via WhatsApp (/anfrage): company, name, WhatsApp number and an optional message, see section 10.
• KI-Werkstatt (/ki-schulung): name, company, email address, optional telephone number and message.
• Job applications (/karriere): see section 14.

The purpose is to handle your enquiry and prepare a conversation. The legal basis is Art. 6(1)(b) GDPR (steps at your request before entering into a contract), and Art. 6(1)(f) GDPR for attribution to an advertisement and internal organisation. Providing data is voluntary; however, we cannot handle an enquiry without a name and a way to contact you. Each form also stores, out of view, the time you opened it and an empty control field, both used only to detect bots.

We receive your enquiry by email (section 11) and also store it in our internal CRM system “dropd OS”, which we operate ourselves on Hetzner Online GmbH servers in Germany. After submission, you receive an acknowledgement. It may contain a personal link to a short preparation questionnaire on our own systems, with your details already filled in.

We delete enquiries that do not result in a contract 12 months after the last contact. If a contract is concluded, the commercial and tax retention periods apply (section 18).

10. Callbacks via WhatsApp

If you request a WhatsApp callback through /anfrage and consent by ticking the checkbox, we contact you through WhatsApp Business (WhatsApp Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland, a Meta company). Meta receives your telephone number and communication metadata (time, device); message content is end-to-end encrypted. Data may be transferred to the US (section 17). The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time, for example by sending us a message. We then use email or telephone for further communication.

11. Email delivery and mailbox

We send form enquiries, acknowledgements and the newsletter through Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, US). Resend processes the recipient address and the content of each email for this purpose. Our own mailbox is operated by Google Ireland Ltd. (Google Workspace). We have data processing agreements with both providers under Art. 28 GDPR; transfers to the US are safeguarded as described in section 17. The legal basis is Art. 6(1)(b) GDPR and, for reliable delivery, Art. 6(1)(f) GDPR.

12. Appointment booking (Google Calendar and Google Meet)

You can book a free strategy call through /beratung, /termin, the package cards or the chat. We process your name, email address, company and chosen appointment, create an event in our Google Calendar and send you an invitation with a Google Meet link. The legal basis is Art. 6(1)(b) GDPR (steps before entering into a contract) and Art. 6(1)(f) GDPR (efficient appointment management).

The provider is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace). Data may be transferred to the US (Google LLC); transfers are safeguarded as described in section 17. We have a data processing agreement with Google under Art. 28 GDPR. The website checks available times without sending your data; your details are transmitted only when you book.

13. Newsletter (KI-Radar)

If you request KI-Radar, we process your email address to send you assessments and practical examples of AI in small and medium-sized businesses. The legal basis is your consent (Art. 6(1)(a) GDPR, section 7(2), no. 2 UWG). We use a double opt-in procedure: after entering your address, you receive an email with a confirmation link. We add your address to the mailing list only after you click it; the link is valid for 24 hours. As evidence, we store the time of sign-up and confirmation.

We maintain the mailing list with Resend, Inc. (US, see section 11); your address is stored there as a contact in a topic-based segment. We do not use your address for other purposes, share it for advertising or use it to train AI models.

You can unsubscribe at any time through the link in each issue or by contacting lucas@dropdigital.de, with no costs other than transmission costs at standard rates. After you unsubscribe, we keep only a suppression record with your address to prevent further emails (Art. 6(1)(f) GDPR).

14. Job applications (/karriere)

If you apply for a job with us, we process your name, email address, optional telephone number, the position, your message and, if uploaded, your CV as a PDF to conduct the application process. The legal basis is section 26(1) BDSG in conjunction with Art. 6(1)(b) GDPR. You do not need to provide special categories of data, such as health data.

We receive your application by email (section 11); your CV is passed through as an attachment and is not stored in another system. We delete the documents within six months after the process ends, unless we need them to defend against claims (section 15 AGG) or you have consented to longer retention for future vacancies.

16. Recipients and processors

Within our company, access is limited to the people who handle your enquiry. We also use the following service providers, with whom we have data processing agreements under Art. 28 GDPR where required:

We disclose data to other third parties only if required by law or with your consent.

17. Transfers to third countries

Some of the providers listed above are based in the US or transfer data there. We base these transfers on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), with additional safeguards such as encryption, and, where the provider is certified, also on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR). The adequacy decision is subject to judicial review, and access to data by US public authorities cannot be ruled out in every case. For voice input in chat, we additionally base the transfer on your explicit consent (Art. 49(1)(a) GDPR).

18. Retention periods

We retain personal data only for as long as necessary for the relevant purpose or as required by statutory retention obligations:

19. Your rights

You have the right to obtain access to your data from us (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): You can object at any time to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation. You can object to processing for direct marketing at any time without giving a reason; we will then stop processing your data for those purposes.

For any request, simply email lucas@dropdigital.de. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Our competent authority is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Kavalleriestraße 2-4, 40213 Düsseldorf, www.ldi.nrw.de. You can also contact the supervisory authority where you live.

20. No automated decision-making

We do not make decisions based solely on automated processing that have legal effects on you (Art. 22 GDPR). People handle enquiries, applications and offers.

21. Changes to this policy

We update this policy when the website, our services or the law changes. The version published here applies; its date appears at the top of this page.