1. Controller
The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Pedalion GmbH
Leopoldstraße 8, 80802 Munich, Germany
represented by its Managing Directors Andreas Jägle and Alessandro Podda
E-mail: contact@pedalion.com
We have not appointed a data protection officer, as the legal requirements for doing so (Art. 37 GDPR, Section 38 BDSG) are not met.
2. Overview
We process personal data to operate this website, to respond to your enquiries and, only with your consent, to analyse how our website is used. Analytics tools (Google Analytics 4 and Microsoft Clarity) are loaded only after you agree in the consent banner. You can change or withdraw your choice at any time via "Privacy settings" in the footer of every page.
3. Hosting and server log files
This website is hosted by GoDaddy (GoDaddy.com, LLC, 2155 E. GoDaddy Way, Tempe, AZ 85284, USA). Our website and its database, including all contact-form entries, are stored exclusively on GoDaddy servers located in Europe.
Each time the website is accessed, the server automatically records: IP address, date and time of access, page requested, referrer URL, browser type and version, operating system, HTTP status code and amount of data transferred.
Purpose: delivering the website, ensuring stability and security, defending against attacks. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and error-free provision of the website. Retention: log files are deleted after 7 days, unless needed longer to investigate a specific security incident.
We have concluded a data processing agreement with GoDaddy under Art. 28 GDPR. Although the data is stored in Europe, GoDaddy is a US company, so access from the USA (for example for support or maintenance) cannot be ruled out. GoDaddy is certified under the EU-U.S. Data Privacy Framework, so transfers are covered by the European Commission's adequacy decision (Art. 45 GDPR). GoDaddy has additionally agreed to the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
Data transmitted between your browser and our server is TLS-encrypted.
4. Contact form ("Get in touch")
When you contact us via the form, we process your name (optional), your e-mail address, your message (optional), the time of submission and the page from which you sent the form. To prevent abuse, the website keeps a hashed form of your IP address for one hour.
How it works: your details are stored in a database on our host GoDaddy's servers in Europe. We receive a notification at contact@pedalion.com, and you receive an automatic confirmation at the address you entered.
Purpose: handling and answering your enquiry, including follow-up questions. Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to entering into a contract or pre-contractual steps; otherwise Art. 6(1)(f) GDPR, our legitimate interest being the efficient handling of enquiries. Provision: voluntary. Without an e-mail address we cannot reply.
We use your e-mail address solely to answer your enquiry. We use it for newsletters or marketing only with your separate consent (see section 6).
Retention: we delete your details once your enquiry has been fully handled, at the latest after 6 months. If a business relationship results, or statutory retention obligations apply (in particular Section 257 HGB, Section 147 AO), we retain the data for that period.
5. Contact by e-mail and AI support
If you e-mail us directly, section 4 applies accordingly. Our mailbox is operated by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as our processor under a data processing agreement. Where data reaches the USA, Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework.
AI support: we use AI tools to help us handle e-mails, including enquiries sent via the contact form (section 4). These tools may sort and summarise incoming messages and help us draft replies. Every reply is reviewed and sent by a member of our team; no decisions about you are made automatically. The AI tools are provided by our IT service providers (such as Microsoft) as processors under data processing agreements, and your messages are not used to train AI models. Where a provider is based outside the EU, transfers are covered by the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.
Legal basis: Art. 6(1)(b) GDPR where your message relates to a contract or pre-contractual steps; otherwise Art. 6(1)(f) GDPR, our legitimate interest being the efficient handling of correspondence.
6. Newsletter
This website currently offers no newsletter sign-up. If you signed up earlier via the newsletter box in the contact form, we send you occasional e-mails about Pedalion's services, projects and events, and the following applies.
Double opt-in: after signing up, you receive an e-mail asking you to confirm. We add your address to the mailing list only once you click the confirmation link. If you do not confirm, we delete the sign-up request after 30 days.
Data processed: your e-mail address, the time of sign-up and confirmation, the IP addresses used for both steps and the wording of the consent you gave.
Purpose: sending the newsletter and documenting your consent. Legal basis: Art. 6(1)(a) GDPR (your consent). We log the sign-up to be able to prove consent (Art. 7(1) GDPR); the legal basis for this is Art. 6(1)(f) GDPR, our legitimate interest being compliance with this obligation.
Withdrawal: you can withdraw your consent at any time via the unsubscribe link in every newsletter or by e-mail to contact@pedalion.com. Withdrawal does not affect the lawfulness of processing before it.
Retention: we keep your address on the mailing list until you unsubscribe. After that, we keep only the e-mail address and the consent record for up to three years, to be able to prove that consent was given. During that time we use the address for no other purpose.
Service provider: until the first newsletter is sent, sign-ups are stored only on our host GoDaddy's servers in Europe (section 3). To send the newsletter, we will use an e-mail delivery service acting as our processor under a data processing agreement. We will name the provider in this section before the first newsletter is sent.
No tracking: we do not measure whether or when you open the newsletter or click links in it.
7. Cookies and consent management
When you first visit our website, a consent banner asks whether you agree to analytics. Google Analytics and Microsoft Clarity are loaded only after you consent. You can change or withdraw your choice at any time via "Privacy settings" in the footer of every page.
The banner is part of this website itself; no third-party consent service is involved. Your decision is stored in your browser (local storage) together with a random consent ID, the date and time, the banner version and your choice for each service. To be able to prove your consent, we also record the same data and your browser type on our server in Europe (section 3). No IP address is stored with the record. To prevent abuse, the website keeps a hashed form of your IP address for one hour, as it does for the contact form (section 4).
Purpose: asking for, storing and proving your consent. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (obligation to prove consent). Storing your decision on your device is strictly necessary for this function (Section 25(2) No. 2 TDDDG). Retention: your decision stays in your browser until you change it or clear your browser storage. The consent record on our server is deleted after three years.
8. Web analytics (Google Analytics 4)
With your consent, we use Google Analytics 4 to understand how visitors use our website, for example which pages are viewed, for how long, how visitors found us, their approximate location and their type of device and browser. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acting as our processor.
Google Analytics sets cookies (_ga, _ga_<ID>) that store a randomly generated identifier for up to two years. Google does not log or store the IP addresses of visitors from the EU; IP addresses are used only to derive an approximate location and are then discarded. We have disabled Google Signals and advertising features.
Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (your consent). Retention: event-level data is deleted from Google Analytics after 14 months; only aggregated reports remain. Third-country transfer: data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); Google has additionally agreed to the EU Standard Contractual Clauses.
9. Session analysis (Microsoft Clarity)
With your consent, we use Microsoft Clarity to understand how visitors interact with our website through heatmaps and session recordings. Clarity records mouse movements, clicks, scrolling, the pages visited, information about your device and browser, and your approximate location. Text entered in form fields is always masked and never sent to Clarity.
The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft also processes Clarity data for its own purposes as an independent controller, including to improve its products; the MUID cookie is also used by Microsoft for advertising purposes. Details: Microsoft Privacy Statement.
Clarity sets cookies such as _clck (Clarity user ID), _clsk (links page views into one session), CLID and MUID, for up to one year.
Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (your consent). Retention: session recordings are deleted after 30 days; heatmaps and a sample of recordings are kept for up to 9 months. Third-country transfer: data may be transferred to Microsoft Corporation in the USA. Microsoft has agreed to the EU Standard Contractual Clauses and is certified under the EU-U.S. Data Privacy Framework.
10. Google Search Console
We use Google Search Console (Google Ireland Limited) to monitor how our website performs in Google Search. Search Console sets no cookies and runs no code on our website. Google provides us with aggregated statistics from Google Search, such as search queries, impressions and clicks, which do not allow us to identify individual visitors.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is improving how our website is found in search results.
11. Recipients
Your data is disclosed only to the service providers named in this policy (GoDaddy, Microsoft, Google and, for the newsletter, an e-mail delivery service) and, where required by law, to public authorities. We do not sell data.
12. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw any consent at any time with effect for the future (Art. 7(3)). A message to contact@pedalion.com is sufficient. You can withdraw your consent to analytics directly via "Privacy settings" in the footer.
Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
Right to lodge a complaint (Art. 77 GDPR): you may complain to a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
13. No automated decision-making
No automated decision-making, including profiling (Art. 22 GDPR), takes place. Where we use AI tools (section 5), they only support our team; every decision and every reply is made by a person.
14. Changes
We update this privacy policy when the website or the law changes. The version published here applies.