Privacy Policy

This page explains which personal data is processed when you visit un-hooked.de, what for, who receives it and what rights you have. We describe what this website actually does.

1. Controller

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Luis Schreiber (sole proprietorship)
Unhooked Marketing
In den Haesen 105
47198 Duisburg
Germany

Email: info@un-hooked.de
Phone: +49 (0) 157 35484062

2. The key points in brief

• Every time you open a page, our host GoDaddy processes technical data such as your IP address (section 3).
• A banner from Cookiebot asks whether you allow cookies for statistics and marketing (section 4).
• Google Analytics and Google Ads only set cookies with your consent, and only with your consent for marketing do we remember which ad or link brought you here. Without consent, they send measurement data to Google without cookies (section 5).
• The calendar for the free audit comes from TidyCal. It loads as soon as you scroll near it or click an audit button, and brings its own services with it (section 6).
• We hold the audit call via Google Meet and only record it with your agreement; the recording is analyzed with the AI service Claude. Emails run through Microsoft 365, and we keep contacts and notes in Pipedrive and Notion (sections 7 to 9).
• There’s no newsletter, no contact form and no user accounts.

3. Hosting and server log files

This website is hosted by GoDaddy. According to the European IP registry, the server address belongs to a GoDaddy network in Germany, registered to Host Europe GmbH in Cologne.

Every time a page is requested, the server automatically stores: your IP address, date and time, the requested address, the status and the amount of data transferred, the page you came from, and details about your browser and device.

We need this data to deliver the website and to protect it against attacks and misuse. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). We don’t combine the log files with other data and only look at them when there’s a reason, such as an attack. How long they are kept is set by GoDaddy for our hosting package.

GoDaddy processes the data on our behalf (Art. 28 GDPR). If data goes to the USA in the process, GoDaddy relies on the EU-U.S. Data Privacy Framework, under which the GoDaddy companies are certified.

We serve this website’s fonts ourselves. Opening our pages sends no request to Google Fonts. Only the embedded calendar loads fonts from Google (section 6).

4. Consent with Cookiebot

On your first visit, a banner asks whether you allow cookies and similar technologies for statistics and marketing. The banner comes from Cookiebot, a service of Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark.

Cookiebot stores your choice in the CookieConsent cookie on your device for up to 12 months. As proof, Cookiebot logs every choice with a truncated IP address, date and time, browser details, the address of the page, a random key and your selection. According to Usercentrics, this data is stored on servers in the EU and deleted after one year.

Legal basis: We have to be able to prove that you consented (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR). Storing your choice on your device is strictly necessary for this (Section 25(2) No. 2 TDDDG).

You can change or withdraw your consent at any time, via the icon at the bottom left of every page or here:

Open cookie settings

Under “Details”, the banner shows exactly which cookies are involved and how long they stay.

5. Google Tag Manager, Google Analytics and Google Ads

Google Tag Manager loads on every page. It controls which Google services load and when, and doesn’t set any cookies itself. It is set up with Google Analytics, Google Ads and the Conversion Linker. For users in the European Economic Area, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Without your consent, which includes before you’ve made a choice in the banner: All Google storage starts as “denied”. Google Analytics and Google Ads then neither set nor read cookies. They do, however, send measurement data to Google without cookies: that a page was viewed, with its address, the time, screen size and browser details, and on the thank-you page, that a booking was made. Google sees your IP address in the process. For advertising, these requests are marked as non-personalized, and identifiers from ad clicks are redacted. The legal basis is our legitimate interest in measuring how the website is used and how well our ads perform (Art. 6(1)(f) GDPR). Nothing is stored on your device in the process. Google keeps the measurement data for as long as set in our Google Analytics and Google Ads accounts.

With your consent for statistics, Google Analytics sets the cookies _ga and _ga_2QW5CHTDWC, measured in Chrome with a lifetime of 400 days. Google Analytics then analyzes which pages you view, for how long, where you came from, with which device and roughly from where. We send two events ourselves: a click on an audit button, with the position of the button on the page, and the visit to the thank-you page after a booking.

With your consent for marketing, Google Ads measures whether a visit via one of our ads led to a click on an audit button or to a booking. For this, the Conversion Linker sets the cookie _gcl_au, measured with a lifetime of 90 days. Google may also add you to audiences for our ads, so that we can show you ads on other websites later (remarketing).

In both cases, the legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time (section 4).

With your consent for marketing, we also remember in your browser’s local storage which ad or link brought you here: the Google Ads click ID, the campaign details from the address, the website you came from and the first page you view on our site. The entry is called uh_attr and expires after 90 days. If you book an appointment, we pass these details to Google Analytics and Google Ads with the booking, to attribute bookings to our ads. Names or email addresses are not included. Without this consent, we store none of it. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). If you withdraw it via the banner (section 4), the entry is deleted.

Google also processes the data in the USA. For Google Ads and Google Analytics, Google relies on the EU-U.S. Data Privacy Framework, under which Google LLC is certified, and alternatively on standard contractual clauses. More in Google’s privacy policy: policies.google.com/privacy

6. Booking with TidyCal

You book the free audit via a calendar on our pages. It comes from TidyCal, a service of Sumo Group Inc., 1305 E. 6th St #3, Austin, TX 78702, USA.

When it loads: The calendar sits in its own frame (iframe). It loads as soon as you scroll near it, click an audit button or open an address with #booking (#termin on the German pages). It loads without prior consent, even if you decline cookies in the banner. From then on, your browser connects to TidyCal and to the services TidyCal embeds in the calendar.

What loads then, measured on October 12, 2026: TidyCal itself with Cloudflare as protection against bots, files via Bunny CDN, fonts from Google Fonts, Google reCAPTCHA, TidyCal’s own Google Tag Manager with Google Analytics, Microsoft Clarity and the payment service Stripe. We don’t use these services ourselves, TidyCal embeds them; Stripe loads because a payment provider is connected in our TidyCal account, you don’t pay anything through the calendar. The providers see your IP address and browser details. The cookies set were cf_clearance, __cf_bm, XSRF-TOKEN and tidycal_session by TidyCal and m by Stripe, with lifetimes between 30 minutes and 400 days. What TidyCal and the embedded services process beyond this is described in TidyCal’s privacy policy: tidycal.com/privacy-policy

When you book, you enter your name, your email address and the address of your store, and optionally your store platform, the marketplaces or feeds you’re interested in and your biggest challenge. TidyCal saves the appointment, sends you a confirmation and creates the link for the call (section 7). After the booking, TidyCal redirects you to our thank-you page. Visiting it counts as a booking in Google Analytics and Google Ads (section 5).

The legal basis for the booking is taking steps toward a contract at your request (Art. 6(1)(b) GDPR). We base loading the calendar without a click on our legitimate interest in offering you the booking without a detour (Art. 6(1)(f) GDPR).

TidyCal is based in the USA. According to TidyCal’s data processing agreement, data leaving the European Economic Area is protected by the EU’s standard contractual clauses. We delete the booking data once we no longer need it for the call and a possible collaboration.

You can also book without the embedded calendar, directly on TidyCal via the link below the calendar, or send us an email.

7. The audit call with Google Meet

We hold the call as a video conference via Google Meet, a service of Google Ireland Limited. Google processes your name, your email address, your IP address and device details and, if you turn on your camera and microphone, video and audio. TidyCal adds the appointment to our Google Calendar, with your name, your email address and the details from your booking. The legal basis is taking steps toward a contract (Art. 6(1)(b) GDPR). For transfers to the USA, Google relies on the EU-U.S. Data Privacy Framework. We keep the appointment in the calendar for as long as we need it for a possible collaboration.

With your agreement, we record the call so that we can prepare the review for you. We ask before the recording starts; without your agreement, we don’t record. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. We make the recording with our own application and store it on our own computer. It is summarized and analyzed with Claude, an AI service by Anthropic; for the European Economic Area, the provider is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland. Anthropic also processes data in the USA and bases transfers there on standard contractual clauses. We store the summary in Pipedrive (section 9). We delete the recording if you withdraw your consent or ask us to, and otherwise as soon as we no longer need it for the review and a collaboration.

8. Email and phone

If you email or call us, we process your details to answer your inquiry. The legal basis is Art. 6(1)(b) GDPR if it concerns a collaboration, otherwise our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR).

Our emails run through Microsoft 365, which we obtain via GoDaddy. For the European Economic Area, the provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework.

We delete emails when we no longer need them, unless commercial or tax law requires us to keep them.

9. Contacts, notes and contracts

We keep contacts, conversations and quotes in Pipedrive, and notes on calls and projects in Notion. This includes your name, your contact details, your company, details from the booking, the summary of the audit call and our notes. The legal basis is taking steps toward or performing a contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in handling inquiries and customers in an orderly way (Art. 6(1)(f) GDPR). We delete the data if no collaboration comes about and we no longer need it, otherwise after the collaboration ends, unless we’re required to keep it.

Pipedrive is a service of Pipedrive, Inc. and its affiliates, Notion a service of Notion Labs, Inc., 685 Market Street, San Francisco, CA 94105, USA. Both also process data in the USA; Pipedrive, Inc. and Notion Labs, Inc. are certified under the EU-U.S. Data Privacy Framework and also use standard contractual clauses.

For quotes and contracts, we process the data of your contact persons (Art. 6(1)(b) GDPR) and keep invoices and business letters for as long as commercial and tax law require (Art. 6(1)(c) GDPR). If we process your customers’ data for you, such as orders in Channable, we do so on your behalf under Art. 28 GDPR.

10. Your language choice in the browser

If you switch between German and English at the top, your browser remembers your choice in local storage, entry langChoice, so that the homepage doesn’t redirect you again. If you open the homepage for the first time with a browser that doesn’t list German first, we redirect you to the English homepage and remember that too. The entry stays until you delete it in your browser and doesn’t leave your device. The legal basis is Section 25(2) No. 2 TDDDG and our legitimate interest in showing you the pages in your language (Art. 6(1)(f) GDPR). After a booking, your browser also remembers in session storage, entry uh_booked, only that the thank-you page has already been counted in this tab, so that a booking isn’t counted twice; this is technically necessary (Section 25(2) No. 2 TDDDG), the entry doesn’t leave your device and ends when you close the tab.

11. Links to other websites

Our pages link to LinkedIn, and blog articles also link to sources such as OpenAI, Channable or trade media. Only when you click a link does your browser connect to the other site, where its privacy policy applies. We don’t embed social media plugins.

12. Recipients and third countries

Your data only goes to the service providers in this policy: GoDaddy, Usercentrics, Google, TidyCal with the services in its calendar, Microsoft, Anthropic, Pipedrive and Notion. Several of them also process data in the USA. For the USA, there is an adequacy decision by the European Commission for companies certified under the EU-U.S. Data Privacy Framework. Where that doesn’t apply, the providers use standard contractual clauses. Access by US authorities still can’t be ruled out.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). To do so, write to us at info@un-hooked.de.

Right to object: If we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

14. Complaint to a supervisory authority

You can lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia.

15. Obligation to provide data, no automated decisions

You don’t have to give us any data. Without your name, email address and the address of your store, however, we can’t give you an appointment for the audit. We don’t make decisions based solely on automated processing that have legal effects on you.

16. Changes

If what this website does changes, we change this policy. The version published here applies.