Privacy

Privacy Policy

Status: 5 August 2026

Important Notice (Transparency) We use external service providers to operate this website and process enquiries. The required Data Processing Agreements (Art. 28 GDPR) are currently being finalized. Until completion, we minimize data, restrict access, activate only essential functions and apply additional safeguards. This notice explains the actual processing operations.

1. Controller Controller under the GDPR:
Worqshop IO UG (haftungsbeschränkt) In den Alboingärten 17, 12103 Berlin, Germany
Email: tech[at]worqshop.io
Phone: +49 160 1517018

Data Protection Officer: not appointed. Currently, no designation obligation exists (Art. 37 GDPR); this is reviewed regularly.

2. Legal Bases Legal bases for processing: - Art. 6 (1) lit. b GDPR – performance or initiation of a contract - Art. 6 (1) lit. f GDPR – legitimate interests (operation, security, communication, workflows) - Art. 6 (1) lit. a GDPR – consent, where optional services are used

3. Hosting & Server Log Files Hosting: Hetzner Online GmbH, Gustav‑Stresemann‑Ring 1, 65189 Wiesbaden, Germany (servers located in Germany); Domain/DNS via united‑domains. Purpose: delivery, stability, IT security, detection of misuse. Legal basis: Art. 6 (1) lit. f GDPR. Retention period: 7–14 days, then deletion or anonymization. Third‑country transfer: possible (e.g. USA); safeguarded by EU Standard Contractual Clauses (SCCs); DPA pending.

Fonts (self‑hosted) The fonts used on this website (Overpass, IBM Plex Mono) are served exclusively from our own server. No connection is made to Google Fonts or any other external font service, and no personal data is transmitted to third parties for this purpose. Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in consistent design). Recipient/third‑country transfer: Google Ireland Ltd. / Google LLC (USA); safeguarded by SCCs.

4. Cookies, Consent Management & Tag Management We use only technically necessary cookies. Optional cookies (analytics, marketing) are set only with consent.

Consent Management & Tag Management (etracker) We use the etracker Consent Manager from etracker GmbH, Hamburg, Germany, to manage consent for cookies and similar technologies. Technical data (IP address, timestamp, consent status, browser information) are processed to document and store consent. Legal basis: - Art. 6 (1) lit. c GDPR (legal obligation to demonstrate consent), - Art. 6 (1) lit. f GDPR (legitimate interest in GDPR‑compliant management). Retention: for the duration of consent or until withdrawal. For implementation, the etracker Tag Manager may activate or block services based on consent. No user profiles are created and no data shared with unrelated third parties. Consent withdrawal: possible at any time with future effect. Further information: https://www.etracker.com/en/data-privacy/

5. Communication & Workflows Purpose: to handle incoming enquiries, maintain communication and manage internal workflows efficiently. Legal basis: Art. 6 (1) lit. b GDPR (performance or initiation of a contract) and Art. 6 (1) lit. f GDPR (legitimate interests in communication and operation). Retention: data stored as long as necessary for the purpose; then deleted under statutory periods.

5.1 Email We process emails to respond to your enquiry. Legal basis: Art. 6 (1) lit. b/f GDPR. Recipient: internal only. Retention: until completion, then per legal obligations.

5.2 Automation (n8n, self‑hosted) Enquiries may be handled via n8n (self‑hosted) workflows (e.g. routing, status tracking, follow‑ups). Legal basis: Art. 6 (1) lit. b/f GDPR. Recipient: internal processing only; no external transfer. Retention: purpose‑based; logs regularly deleted or anonymized.

5.3 Google Workspace We use Google Workspace by Google Ireland Limited, Dublin, Ireland (email, file storage, documents) to handle enquiries and for internal collaboration. This may involve the content of your enquiry and associated metadata; data minimisation applies. Legal basis: Art. 6 (1) lit. b GDPR (initiation or performance of a contract) and Art. 6 (1) lit. f GDPR (legitimate interest in functioning communication). Recipients / third‑country transfer: Google (EU / USA); secured via EU Standard Contractual Clauses (SCCs). Retention: purpose‑based; deleted after completion or on request.

5.4 Appointment Booking (Cal.com) For scheduling calls we use Cal.com by Cal.com, Inc., USA. Opening the booking overlay establishes a connection to Cal.com servers. Processed data: IP address, browser and device information, and the booking details you enter (name, email address, requested slot, optional notes). Purpose: arranging and managing appointments. Legal basis: Art. 6 (1) lit. b GDPR (pre‑contractual measures) and Art. 6 (1) lit. f GDPR (legitimate interest in efficient scheduling). Third‑country transfer: USA; secured via EU Standard Contractual Clauses (SCCs). Retention: until the purpose is fulfilled, then deletion.

6. Web Analytics & Tag Management (etracker) This website uses etracker GmbH, Hamburg (www.etracker.com), for usage data analysis. The etracker Consent Manager module handles consent management, and the etracker Tag Manager controls external scripts according to user consent. Even if statistical cookies are rejected, usage data are collected in compliance with GDPR and TDDDG. Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in optimisation and lawful integration); where consent applies, Art. 6 (1) lit. a GDPR. Processing location: exclusively in Germany; no data disclosure to third parties. Certification: ePrivacyseal. Data minimization: IPs and IDs anonymized/pseudonymized. Right to object: possible any time via opt‑out without disadvantage. More information: https://www.etracker.com/en/data-privacy/

6.1 Reddit Pixel (marketing, only with consent) If you have consented to the “Marketing” category, we load the conversion pixel of Reddit, Inc., 303 2nd Street, San Francisco, CA 94107, USA. Processed data: IP address, browser and device information, and information about your behaviour on this website (pages viewed, events such as a booking or an enquiry). Without your consent the pixel is not loaded; no data is transmitted to Reddit and no cookies are set. Purpose: measuring the effectiveness of advertising campaigns on Reddit. Legal basis: Art. 6 (1) lit. a GDPR (consent); Sec. 25 (1) TDDDG for storing information on your device. Withdrawal: at any time via “Cookie settings” in the footer. Third‑country transfer: USA; secured via EU Standard Contractual Clauses (SCCs).

6.2 Meta Pixel (marketing, only with consent) If you have consented to the “Marketing” category, we use the Meta Pixel of Meta Platforms Ireland Ltd., Dublin, Ireland. Processed data: IP address, browser and device information, the cookies set by Meta, and the advertising click identifier you arrived with. We also transmit which pages you viewed and events such as viewing a service or clicking the Sparring button. Without your consent the pixel is not loaded, no cookies are set and no data is transmitted. Purpose: measuring and optimising advertising campaigns. Legal basis: Art. 6 (1) lit. a GDPR (consent); Sec. 25 (1) TDDDG. Withdrawal: at any time via “Cookie settings” in the footer. Third‑country transfer: USA; secured via EU Standard Contractual Clauses (SCCs).

6.3 LinkedIn Insight Tag (marketing, only with consent) If you have consented to the “Marketing” category, we use the LinkedIn Insight Tag of LinkedIn Ireland Unlimited Company, Dublin, Ireland. Processed data: IP address, browser and device information, the cookies set by LinkedIn, and the LinkedIn click identifier you arrived with. We also transmit when you click the Sparring button. LinkedIn may combine this data with your LinkedIn profile if you are logged in there. Without your consent the tag is not loaded, no cookies are set and no data is transmitted. Purpose: measuring advertising campaigns on LinkedIn. Legal basis: Art. 6 (1) lit. a GDPR (consent); Sec. 25 (1) TDDDG. Withdrawal: at any time via “Cookie settings” in the footer. Third‑country transfer: USA; secured via EU Standard Contractual Clauses (SCCs).

6.4 Google Ads (marketing, only with consent) If you have consented to the “Marketing” category, we use Google Ads by Google Ireland Limited, Dublin, Ireland. Processed data: IP address, browser and device information, the cookies set by Google, and the Google click identifier (gclid) you arrived with. We also transmit which services you viewed. We do not use Google Analytics. Without your consent nothing is loaded, no cookies are set and no data is transmitted. Purpose: building remarketing audiences and measuring advertising campaigns. Legal basis: Art. 6 (1) lit. a GDPR (consent); Sec. 25 (1) TDDDG. Withdrawal: at any time via “Cookie settings” in the footer. Third‑country transfer: USA; secured via EU Standard Contractual Clauses (SCCs).

6.5 Mouseflow (marketing, only with consent) If you have consented to the “Marketing” category, we use Mouseflow by Mouseflow ApS, Flæsketorvet 68, 1711 Copenhagen, Denmark. Mouseflow records anonymised session replays and derives heatmaps and funnel analyses from them. Processed data: anonymised IP address, mouse movement, clicks and scrolling, pages viewed and navigation paths, browser and device information, and location at country level. We do not record keystrokes — keystroke logging is disabled for this project. It sets the mf_user cookie with a lifetime of up to five years. Session recordings are kept for a maximum of 90 days. We do not record the “Marketing System Score” page. Without your consent Mouseflow is not loaded, no cookies are set and nothing is recorded. Purpose: improving the usability and clarity of our pages. Legal basis: Art. 6 (1) lit. a GDPR (consent); Sec. 25 (1) TDDDG. Withdrawal: at any time via “Cookie settings” in the footer. Storage location: EU (Denmark), no third‑country transfer.

7. Recipients / Processors (Overview) To operate this website and process enquiries, we use: Hetzner Online GmbH (hosting, servers in Germany); united‑domains (domain/DNS); Google Ireland Limited (Google Workspace: email, storage, documents; EU / USA); etracker GmbH (analytics / consent / tag management); Mouseflow ApS (behaviour analytics, EU / Denmark, only with consent); Google Ireland Limited (Google Ads conversion tracking, EU / USA, only with consent); LinkedIn Ireland Unlimited Company (advertising measurement, EU / USA, only with consent); Meta Platforms Ireland Ltd. (advertising measurement, EU / USA, only with consent); Cal.com, Inc. (appointment booking, USA); Reddit, Inc. (conversion measurement, USA, only with consent); n8n (self‑hosted automation). DPAs (Art. 28 GDPR) are in progress. Transfers to third countries are secured through SCCs and safeguards.

8. Storage Period Personal data are processed only as long as necessary for their purpose. After statutory retention periods (e.g. commercial or tax law), data are deleted or anonymized.

9. Your Rights You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing under Art. 6 (1) lit. f GDPR. You may withdraw consent at any time with future effect. Right to complain: Berlin Commissioner for Data Protection and Freedom of Information.

10. Security & Updates We implement technical and organizational measures per Art. 32 GDPR. This policy is updated as necessary; the current version is always available here.