Privacy notice

1. Data controller

The data controller responsible for the processing of personal data on this website within the meaning of the GDPR is:

2. Hosting

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel operates the infrastructure required to deliver the site. A data-processing agreement (DPA) is in place; data transfers to the USA take place on the basis of the EU Standard Contractual Clauses (SCCs).

3. Server log files

When you access this website, technically necessary data are stored in server log files: IP address (shortened where possible), date and time of the request, requested URL, referrer and user agent. The legal basis is Art. 6(1)(f) GDPR (ensuring stable operation and defending against attacks). Retention period: [e.g. 14 days].

4. Audience measurement with Vercel Analytics

We use Vercel Web Analytics, a service of Vercel Inc., for aggregated evaluation of page views. Vercel Analytics sets no cookies and processes no personal identifiers; an anonymous daily hash is derived from IP address and user agent and discarded after 24 hours.

Although Vercel Analytics sets no cookies and, in the provider's view, does not constitute terminal-device access within the meaning of §25 TTDSG, we load the service only after your consent as a precaution. The legal basis is therefore Art. 6(1)(a) GDPR. You can withdraw your consent at any time — see section 10.

5. Google Analytics 4

Where you have consented, we use Google Analytics 4 (GA4), a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. GA4 uses cookies and similar technologies to evaluate your use of the website. The data processed includes, among other things, a truncated IP address, device and browser information, approximate location, pages visited, time spent and interactions. We have enabled IP anonymisation.

In this process, data may be transferred to Google LLC in the USA; this is based on the EU Standard Contractual Clauses and Google's certification under the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(a) GDPR in conjunction with §25(1) TTDSG (consent). You can withdraw your consent at any time with effect for the future — see section 10.

We use Google Consent Mode v2. The Google tag library (gtag.js) is loaded on every page, but defaults to "denied" mode. Before you consent, no cookies or identifiers are set and no personal analytics data is collected; only anonymous, cookieless signals without any personal reference are transmitted. Cookies are set and the processing described in section 5 is activated only after you have given your consent.

6. HubSpot (tracking & meetings)

If you have consented, we additionally load the tracking script of HubSpot Inc., 2 Canal Park, Cambridge, MA 02141, USA. HubSpot sets cookies (e.g. __hstc, hubspotutk, __hssc, __hssrc), records page views and interactions, and may associate these with your profile on later contact.

Data processed includes IP address, device and browser information, pages viewed, timestamps and any contact data you enter during a meeting booking. Transfer to the USA is based on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework, under which HubSpot is certified. Cookie retention is up to 13 months; stored contact data are deleted once the purpose ceases.

The legal basis is Art. 6(1)(a) GDPR in conjunction with §25(1) TTDSG (consent). You can withdraw your consent at any time with effect for the future — see section 10.

7. Contact by email

If you contact us by email, we process the data you provide solely to handle your request. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in efficient communication). The data are deleted as soon as they are no longer required for the purpose and no statutory retention obligations stand in the way.

8. Booking via HubSpot Meetings

On the /termin page we embed the HubSpot Meetings booking calendar. The embed script and any cookies set within the embed are functionally necessary in order to accept your booking — we therefore load them irrespective of your consent to the marketing tracking described in section 6. If you don't visit /termin, the embed is not loaded.

The data you enter (name, email address, preferred time, any optional details) and technical embed data are transmitted to HubSpot Inc., 2 Canal Park, Cambridge, MA 02141, USA and processed there on our behalf. Transfer to the USA is based on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework (HubSpot certified). The legal basis is Art. 6(1)(b) GDPR (taking pre-contractual measures at your request).

9. Your rights as a data subject

You have the following rights at any time:

• Access to the data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• Lodging a complaint with a data-protection supervisory authority (Art. 77 GDPR)

To exercise these rights, an informal message to leon[at]helios-capital.de is sufficient.

10. Manage cookies & consent

You can adjust or withdraw your consent to optional cookies and tracking at any time.