Privacy Policy

Last updated: October 2026

1. Controller

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Pedalion GmbH (in formation)
Leopoldstraße 8, 80802 Munich, Germany
represented by its Managing Directors Andreas Jägle and Alessandro Podda.
E-mail: contact@pedalion.com

We have not appointed a data protection officer, as the legal requirements for doing so (Art. 37 GDPR, Section 38 BDSG) are not met.

2. Overview

We process personal data only to the extent necessary to operate this website and respond to your enquiries. This website sets no cookies, uses no analytics or tracking tools and loads no third-party content.

3. Hosting and server log files

This website is hosted by GoDaddy (GoDaddy.com, LLC, 2155 E. GoDaddy Way, Tempe, AZ 85284, USA). Our website and its database, including all contact-form entries, are stored exclusively on GoDaddy servers located in Europe.

Each time the website is accessed, the server automatically records: IP address, date and time of access, page requested, referrer URL, browser type and version, operating system, HTTP status code and amount of data transferred.

Purpose: delivering the website, ensuring stability and security, defending against attacks. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and error-free provision of the website. Retention: log files are deleted after 7 days, unless needed longer to investigate a specific security incident.

We have concluded a data processing agreement with GoDaddy under Art. 28 GDPR. Although the data is stored in Europe, GoDaddy is a US company, so access from the USA (for example for support or maintenance) cannot be ruled out. GoDaddy is certified under the EU-U.S. Data Privacy Framework, so transfers are covered by the European Commission's adequacy decision (Art. 45 GDPR). GoDaddy has additionally agreed to the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Data transmitted between your browser and our server is TLS-encrypted.

4. Contact form (“Get in touch”)

When you contact us via the form, we process your e-mail address, the time of submission and, if you provide one, your comment.

How it works: your details are stored in a database on our host GoDaddy's servers in Europe. We receive a notification at contact@pedalion.com, and you receive an automatic confirmation at the address you entered.

Purpose: handling and answering your enquiry, including follow-up questions. Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to entering into a contract or pre-contractual steps; otherwise Art. 6(1)(f) GDPR, our legitimate interest being the efficient handling of enquiries. Provision: voluntary. Without an e-mail address we cannot reply.

We use your e-mail address solely to answer your enquiry. We use it for newsletters or marketing only with your separate consent (see section 6).

Retention: we delete your details once your enquiry has been fully handled, at the latest after 6 months. If a business relationship results, or statutory retention obligations apply (in particular Section 257 HGB, Section 147 AO), we retain the data for that period.

5. Contact by e-mail

If you e-mail us directly, section 4 applies accordingly. Our mailbox is operated by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as our processor under a data processing agreement. Where data reaches the USA, Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework.

If you tick the newsletter box in the contact form, we send you occasional e-mails about Pedalion's services, projects and events.

Double opt-in: after signing up, you receive an e-mail asking you to confirm. We add your address to the mailing list only once you click the confirmation link. If you do not confirm, we delete the sign-up request after 30 days.

Data processed: your e-mail address, the time of sign-up and confirmation, the IP addresses used for both steps and the wording of the consent you gave.

Purpose: sending the newsletter and documenting your consent. Legal basis: Art. 6(1)(a) GDPR (your consent). We log the sign-up to be able to prove consent (Art. 7(1) GDPR); the legal basis for this is Art. 6(1)(f) GDPR, our legitimate interest being compliance with this obligation.

Withdrawal: you can withdraw your consent at any time via the unsubscribe link in every newsletter or by e-mail to contact@pedalion.com. Withdrawal does not affect the lawfulness of processing before it.

Retention: we keep your address on the mailing list until you unsubscribe. After that, we keep only the e-mail address and the consent record for up to three years, to be able to prove that consent was given. During that time we use the address for no other purpose.

Service provider: until the first newsletter is sent, sign-ups are stored only on our host GoDaddy's servers in Europe (section 3). To send the newsletter, we will use an e-mail delivery service acting as our processor under a data processing agreement. We will name the provider in this section before the first newsletter is sent.

No tracking: we do not measure whether or when you open the newsletter or click links in it.

7. No cookies, no tracking

This website neither stores information on nor reads information from your device (no cookies, no local storage, no pixels). Fonts and all other resources are served from our own server. Consent under Section 25 TDDDG is therefore not required.

8. Recipients

Your data is disclosed only to the processors named above (GoDaddy, Microsoft and, for the newsletter, an e-mail delivery service) and, where required by law, to public authorities. We do not sell data.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw any consent at any time with effect for the future (Art. 7(3)). A message to contact@pedalion.com is sufficient.

Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint (Art. 77 GDPR): you may complain to a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

10. No automated decision-making

No automated decision-making, including profiling (Art. 22 GDPR), takes place.

11. Changes

We update this privacy policy when the website or the law changes. The version published here applies.