Privacy policy

1. Controller

The controllers within the meaning of the GDPR are the founders of COMPBRAIN (in the process of being founded):

Paul Spenlen, Promenadenweg 87, 53175 Bonn
Christopher Mertens, Metzer Straße 6, 40476 Düsseldorf
Email: info@compbrain.de

2. Hosting and server log files

This website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. Any transfer to the USA takes place on the basis of the EU standard contractual clauses. When the pages are accessed, the provider automatically collects and stores information in so-called server log files that your browser transmits: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request and the IP address.

The legal basis is Art. 6 (1) (f) GDPR. We have a legitimate interest in the technically flawless presentation and the security of our website. A data processing agreement (Art. 28 GDPR) is in place with the hosting provider.

3. Cookies and consent

Without your consent this website sets no non-essential cookies. On your first visit a cookie banner asks for your decision; it is stored locally in your browser. Only once you agree is Google Analytics loaded (point 10) or the booking calendar activated (point 9). No profiling and no automated decision-making within the meaning of Art. 22 GDPR takes place. You can change or withdraw your decision at any time via the “Cookie settings” button. Alongside cookies we use your browser’s local storage for this. It holds nothing but your cookie decision and the colour scheme you selected (light or dark). Both are required to operate the website and therefore need no consent under § 25 (2) no. 2 TDDDG; the entries never leave your device.

4. Contacting us and enquiry form

If you contact us by email, the information you provide, including the contact details you supply, is stored in order to process your enquiry and in case of follow-up questions. The legal basis is Art. 6 (1) (b) GDPR (if your enquiry relates to a contract) or Art. 6 (1) (f) GDPR (legitimate interest in responding). We do not pass this data on without your consent.

The contact page additionally offers an enquiry form. It processes your name and email address as mandatory fields and, each of them optional, your telephone number, your message and the topics you select. Without a name and an email address we cannot answer the enquiry; the remaining details serve solely to prepare the conversation.

Your details are not stored in a database. They are sent straight to our mailbox as an email with a PDF summary. The recipient is our email service provider, with whom a data processing agreement pursuant to Art. 28 GDPR is in place. We do not pass the data on to any further third parties.

The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR, which you give via the checkbox in the form and may withdraw at any time with effect for the future, and Art. 6 (1) (b) GDPR insofar as your enquiry aims at concluding a contract.

The form contains a field invisible to you that catches automated submissions. If it is filled in, we discard the submission without further processing. The legal basis is Art. 6 (1) (f) GDPR and our legitimate interest in warding off spam.

5. Retention period

We process personal data only for as long as is necessary for the respective purposes or as statutory retention periods require. Server log files are deleted after 30 days at the latest. Enquiries received via the form or by email are deleted once they have been dealt with conclusively, and after two years at the latest. Your cookie decision and the colour scheme you selected remain in your browser until you withdraw them or clear your browser data.

6. SSL/TLS encryption

For security reasons this website uses SSL/TLS encryption. You can recognize an encrypted connection by the “https://” in your browser’s address bar.

7. Your rights

You have the right at any time to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and a right to object (Art. 21 GDPR). Please contact the email address given above. You may withdraw any consent given at any time with effect for the future. We are not required to appoint a data protection officer (§ 38 (1) BDSG); your requests are handled by the controllers named above themselves.

8. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence, your place of work or the place of the alleged infringement.

9. Appointment booking via Google Calendar

On the “Appointment” page we offer online appointment booking via Google Calendar (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The booking calendar is loaded only after your explicit consent (“Load calendar”) — before that, no data is transmitted to Google and no cookies are set (a so-called two-click solution).

Once loaded, Google processes the data you enter (e.g. name, email, chosen time slot) as well as technical data (including your IP address) and sets cookies in your browser. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you may withdraw at any time with effect for the future. A transfer to the USA may take place and is based on the EU standard contractual clauses. Further information can be found in Google’s privacy policy.

Alternatively you can always reach us without Google, directly by email at info@compbrain.de.

10. Web analytics with Google Analytics 4

This website uses — only after your consent via the cookie banner (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG) — Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Without your consent the service is not loaded and no analytics cookies are set (Google Consent Mode v2, default setting “denied”).

Google Analytics uses cookies and similar technologies to analyze the use of the website (e.g. pages visited, time spent, browser used, approximate region of origin). IP addresses are not stored by Google Analytics 4; processing takes place partly on servers in the USA on the basis of the EU standard contractual clauses and the EU-US Data Privacy Framework. The retention period for analytics data is a maximum of 14 months.

You may withdraw your consent at any time with effect for the future via the “Cookie settings” button. Further information can be found in Google’s privacy policy.