Privacy Policy

1. What this policy covers

Protecting your personal data is important to us. This policy applies to the website schnaq.com as well as to any contact with schnaq GmbH by email, phone or post.

‘Personal data’ means any information relating to an identified or identifiable natural person — for example your name, email address or IP address. We process such data only in line with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

2. Controller and data-protection contact

The controller within the meaning of Art. 4 (7) GDPR is:

schnaq GmbH c/o TechHub.K67 Kasernenstr. 67 40213 Düsseldorf, Germany Email: info@schnaq.com Phone: +49 156 78354553

We have not appointed a data protection officer within the meaning of Art. 37–39 GDPR. Please direct any data-protection questions to info@schnaq.com.

3. Which data we process and when

Different data are processed depending on how you interact with us:

• When you visit our website. When you visit schnaq.com, our servers and the edge layer of our service providers automatically collect technical connection data: your IP address, date and time of the request, the URL accessed, the referrer, your browser and version, the operating system and HTTP status codes. We need this data to actually deliver the page to you and to detect and prevent abuse. The legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in operating the site securely).

• When you contact us by email, phone or post. If you write or call us, we process the content of your message together with your contact details (name, email address, phone number where provided, postal address, company context). The legal basis is Art. 6 (1) lit. b GDPR for requests aimed at entering into or performing a contract, otherwise Art. 6 (1) lit. f GDPR (legitimate interest in handling your request).

• When you book an initial call via Google Calendar. The booking CTA on our site opens a Google Calendar booking dialog operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you book a slot, you submit your data (typically name, email address and preferred time) directly to Google, who then delivers it to us as a calendar entry. The legal basis for our subsequent processing of the appointment is Art. 6 (1) lit. b GDPR (steps prior to entering into a contract).

• During active consulting and development engagements. When working on a mandate, we process master and contract data of our points of contact (name, role, business contact details), project communications and any content you provide for the work. The legal basis is Art. 6 (1) lit. b GDPR. Where we process third-party data on behalf of our clients, we do so under a separate data-processing agreement as required by Art. 28 GDPR.

• Reach and usage measurement with Vercel Web Analytics and PostHog. We use two tools to measure reach and improve our website. Vercel Web Analytics (Vercel Inc.) provides cookieless traffic and performance metrics (e.g. Core Web Vitals) without building personal profiles. PostHog (PostHog Inc.) complements this with cookieless product analytics: the distinct ID required for analysis lives only in your browser's memory and is discarded when you close the tab. No cookies are set, nothing is written to local storage, no IP address is stored and no session recordings are taken. We capture aggregated events such as visited routes, clicks on the booking CTA, section visibility and scroll depth, plus high-level technical information such as browser/device class and UTM parameters. Data is delivered through our reverse proxy `p.schnaq.com` to the PostHog EU data centre in Frankfurt. The legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in improving our offering).

4. Legal bases at a glance

Which legal basis we rely on depends on the purpose of the processing. The bases we use are:

5. Cookies and similar technologies

Our website is intentionally data-minimal. We do not use marketing, advertising or tracking cookies. Only strictly necessary cookies and mechanisms are used:

• CSRF token (session cookie). We set a randomly generated token that protects forms and security-relevant actions from cross-site request forgery. The cookie is deleted when you leave our site. The legal basis is Section 25 (2) no. 2 TDDDG together with Art. 6 (1) lit. f GDPR.

We do not use any tracking cookies, pixels or fingerprinting for advertising or profiling. Our reach measurement (Vercel Web Analytics) is cookieless as well.

6. Recipients and processors

We only share personal data with third parties where this is necessary to provide our services, where a legal obligation requires it, or where you have consented. Inside schnaq GmbH only those people receive access who need it to handle your request.

To operate the website and our applications we work with carefully selected processors under data-processing agreements as required by Art. 28 GDPR. You will find the full list in the appendix below.

7. Transfers to third countries

Some of our service providers are based — or have processing locations — outside the European Economic Area, particularly in the United States. For these transfers we ensure an adequate level of protection as follows:

• For providers certified under the EU-US Data Privacy Framework (currently Cloudflare, Vercel, Google and PostHog), an adequacy decision of the European Commission applies (Art. 45 GDPR).
• If we engage processors without an adequacy decision in the future, we enter into the EU Standard Contractual Clauses under Art. 46 (2) lit. c GDPR and, where necessary, apply additional technical and organisational measures.
• An overview of the mechanism applicable to each provider is included in the appendix.

8. Retention and deletion

We store personal data only for as long as needed for the relevant purpose or as required by statutory retention rules.

Server logs are typically deleted within a few days, at the latest after 30 days. Email or phone inquiries are retained only as long as needed to handle your request and any related follow-up, for at most three years. Contract and accounting data are subject to the commercial and tax retention periods of up to ten years (Section 257 HGB, Section 147 AO).

For any longer retention we consider the scope, type and sensitivity of the data, potential risks and the applicable legal provisions.

9. Your rights

As a data subject you have the following rights vis-à-vis schnaq GmbH. You can exercise them informally by emailing info@schnaq.com.

1. Right of access (Art. 15 GDPR): You can ask us whether and which personal data we process about you and receive a copy of that data.

2. Rectification (Art. 16 GDPR): If data concerning you are inaccurate or incomplete, you can ask us to correct or complete them.

3. Erasure (Art. 17 GDPR): You can request the deletion of your data, provided no statutory retention obligation or other overriding ground prevents it.

4. Restriction of processing (Art. 18 GDPR): Under the conditions of Art. 18 GDPR you can ask us to restrict the processing of your data — for example while we are checking the accuracy of a record.

5. Data portability (Art. 20 GDPR): Data you provided to us based on consent or for a contract can be transmitted to you, or — where technically feasible — directly to another controller, in a structured, commonly used and machine-readable format.

6. Withdrawal of consent (Art. 7 (3) GDPR): Where processing is based on your consent, you can withdraw it at any time with future effect. The lawfulness of any processing carried out before the withdrawal remains unaffected.

10. Changes to this policy

We update this policy when our processing activities or legal requirements change. You will find the current version at the top of this page. We recommend re-reading it from time to time.

Appendix: Service providers in use

The following processors and service providers are currently involved in operating this website: