Privacy Policy

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

C. Misselwitz & C. Wheeler letsrocc GbR
Kupferhammer 39
60439 Frankfurt am Main
Germany

Email:
Web: www.letsrocc.com

VAT ID: DE361434111

2. Overview of Data Processing

The following overview summarises the types of data processed and the purposes of their processing:

• Contact data (name, email address)
• Company data (company name, position, revenue range)
• Content data (enquiries, challenges, context information)
• Usage data (access times, pages)
• Meta/communication data (IP addresses, browser information)

3. Legal Basis

Processing is carried out on the following legal bases:

• Art. 6(1)(a) GDPR (Consent): You have given consent to the processing.
• Art. 6(1)(b) GDPR (Contract Performance): Processing is necessary for the performance of a contract or pre-contractual measures.
• Art. 6(1)(f) GDPR (Legitimate Interests): Processing is necessary to protect our legitimate interests, provided your interests do not override.

4. Contact Form

When you contact us (e.g. via contact form or email), the information you provide is stored for the purpose of processing your enquiry and for follow-up questions.

Data types processed: Name, email address, company, position, revenue range, challenge, context information, language preference.
Legal basis: Art. 6(1)(b) GDPR for pre-contractual enquiries or Art. 6(1)(f) GDPR for responding to other business enquiries.
Retention period: Your data is deleted once it is no longer necessary for the purpose for which it was collected, but no later than 24 months.

5. Email Communication

When you contact us via the contact form, you will receive an automatic confirmation email. We use Postmark as our email service provider for transactional emails.

Provider: Postmark (Wildbit LLC), USA
Privacy notice: postmarkapp.com/eu-privacy

6. CRM System

We use HubSpot as our CRM system for managing customer relationships and enquiries. Data from the contact form is transmitted to HubSpot.

Provider: HubSpot, Inc., USA
Data processed: Name, email address, company, position, enquiry
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient customer management)
Privacy notice: legal.hubspot.com/privacy-policy

7. Newsletter

If you subscribe to our newsletter, we process your business email address, language preference, sign-up source and sign-up time. Subscription is voluntary and is based on your consent under Art. 6(1)(a) GDPR. The address is stored in our database, sent to HubSpot to manage the subscription and used by Postmark for delivery. You may withdraw consent for the future at any time by replying with an unsubscribe request or emailing . We retain the data until withdrawal and afterwards only where required to demonstrate consent or meet a legal obligation.

8. Web Analytics

Google Tag Manager & Google Analytics

This website uses Google Tag Manager to manage website tags. Google Tag Manager itself does not set cookies or collect personal data. However, other services such as Google Analytics may be integrated through the Tag Manager.

Provider: Google Ireland Limited, Ireland
Data processed: IP address (anonymised), usage data, device information
Legal basis: Art. 6(1)(a) GDPR (consent)
Privacy notice: policies.google.com/privacy
Opt-out: Google Analytics Opt-out Browser Add-on

9. Hosting and Server

This website runs on managed infrastructure provided by Abacus.AI. Form submissions and editorial administration data are stored in a PostgreSQL database provided by Supabase in its Frankfurt EU region. Technical server-log data may be processed whenever the site is accessed.

Data collected: IP address, date/time, page accessed, browser type, operating system.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
Recipients: Abacus.AI and Supabase, Inc. as technical service providers.
Retention period: Log data is retained only for as long as needed for security, fault diagnosis and operation. The precise period depends on the relevant service configuration.

10. Cookies

Essential local storage is used to operate the website. Analytics and the optional website chat load only after your explicit selection.

Essential local storage:
• cookie_consent – Stores your privacy choices for up to twelve months.

Analytics cookies (only with consent):
• _ga and _ga_* – Google Analytics cookies used to recognise browsers pseudonymously

Optional marketing measurement (only with separate consent):
• _fbp and _fbc may be set by Meta on campaign landing pages configured to use its pixel.

You can change your choice at any time through “Cookie Settings” in the footer. Withdrawal applies to future processing.

11. External Services

Optional campaign measurement

Individual campaign landing pages may use Google Ads conversion measurement or the Meta Pixel. Google measurement events are loaded only after you consent to analytics. The Meta Pixel is loaded only after your separate consent to marketing measurement and is provided by Meta Platforms Ireland Limited. Technical connection, device and usage data, together with information about the page view, may then be processed and may be transferred to the USA. The legal basis is Art. 6(1)(a) GDPR. These measurements are not loaded without consent.

Calendly

We use Calendly for appointment booking. The calendar loads only after you choose it on the booking page. Calendly then receives technical connection data. If you book, Calendly also processes the contact and appointment details you enter.
Provider: Calendly LLC, USA
Legal basis: Art. 6(1)(a) GDPR for loading the calendar and Art. 6(1)(b) GDPR for the appointment you request.
Privacy notice: calendly.com/legal/privacy-notice

YouTube

We embed videos through the privacy-enhanced youtube-nocookie.com domain. No connection to YouTube is made until you choose to load a video. Google Ireland Limited and related companies may then receive your IP address and device and usage data. The legal basis is your consent under Art. 6(1)(a) GDPR. If you follow an external YouTube link, YouTube's own privacy terms apply.

Optional website chat

The optional website chat is provided by Abacus.AI and loads only if you allow external services in the privacy settings. Technical connection data and anything you enter in the chat may then be processed. Do not enter confidential, financial or third-party personal data. The legal basis is your consent under Art. 6(1)(a) GDPR.

Google Fonts

This website uses Google Fonts for consistent typography. The fonts are hosted locally, so no connection to Google servers is established.

12. Data Transfer to Third Countries

Some providers or related companies are based in the USA, including Postmark, HubSpot, Calendly, Google/YouTube, Supabase and Abacus.AI. Where applicable, transfers are based on:

• EU-U.S. Data Privacy Framework (for certified companies)
• Standard contractual clauses (Art. 46(2)(c) GDPR)
• Consent (Art. 49(1)(a) GDPR)

13. Your Rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You can request information about your processed data.
• Right to rectification (Art. 16 GDPR): You can request correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): You can request deletion of your data.
• Right to restriction (Art. 18 GDPR): You can request restriction of processing.
• Right to data portability (Art. 20 GDPR): You can receive your data in a machine-readable format.
• Right to object (Art. 21 GDPR): You can object to processing.
• Right to withdraw consent (Art. 7(3) GDPR): You can withdraw consent at any time.
• Right to lodge a complaint (Art. 77 GDPR): You can complain to a supervisory authority.

To exercise your rights, please contact us at:

13a. Required information and automated decisions

Providing personal data is generally voluntary. Without required fields, however, we cannot process an enquiry, subscription or booking. We do not use this website to make solely automated decisions that produce legal or similarly significant effects, and we do not conduct related profiling.

14. Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. For the UK, this is the Information Commissioner's Office (ICO). For Germany (Hesse), the competent authority is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden
Germany
Web: datenschutz.hessen.de

15. Changes to This Privacy Policy

We reserve the right to amend this privacy policy to reflect changes in the legal situation or changes to our services. The current version applies from the date stated above.