Privacy policy

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Controller

Davyd Pavlovskyi
trading as “OutreachLab”

Address

Trabener Str. 85D, 14193 Berlin, Germany

Phone

+49 179 1585142

Email

david@tryoutreachlab.com

We have not appointed a data protection officer, as there is no legal obligation to do so (Art. 37 GDPR, § 38 BDSG). If you have any questions about data protection, please contact us using the details above.

• We use cookies and similar technologies that can recognise your device only for web analytics – and only if you consent in the banner. Without your consent, no analytics takes place.
• For web analytics we use PostHog, with data stored in Frankfurt am Main. We do not store IP addresses in the process and do not collect form input. You can withdraw your consent at any time via “Cookie settings” in the footer.
• Beyond that, we do not embed any advertising or social media services or any other third-party content; even the fonts are delivered with the website itself.
• We process personal data when you visit the pages (technically necessary server log files) and when you contact us via a form, by email or by phone.
• Without your consent, we only store your choice in the banner on your device and – if you switch it yourself – the display (light/dark).

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (“Vercel”). Vercel delivers the pages via a global server network (edge network), usually from the location closest to you. Server functions – such as processing the forms – run in a data centre in Frankfurt am Main, Germany (region “fra1”).

Each time the website is accessed, Vercel automatically processes data transmitted by your browser (server log files):

• IP address,
• date and time of access,
• requested address (URL) and request method,
• previously visited page (referrer), if transmitted,
• browser and operating system (user agent),
• HTTP status code of the response.

Purpose and legal basis: delivering the website and ensuring its stability and security, in particular detecting and preventing attacks and abusive requests. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing the website securely and reliably. We do not combine this data with other data or use it to identify you.

Retention: the logs are available to us only briefly (currently no longer than one day) and are then deleted automatically. Vercel may retain log data for longer for security purposes in accordance with its own retention periods; see Vercel’s privacy notice: vercel.com/legal/privacy-notice.

Vercel processes the data as a processor on our behalf (Art. 28 GDPR). For transfers to the USA, see Recipients and transfers to third countries.

You can reach us via the contact form, by email or by phone. We then process the information you send us – for the contact form, your name, email address and message and, if provided, your company.

Purpose and legal basis: we process the data to answer your enquiry. If your enquiry is aimed at concluding a contract, the legal basis is Art. 6(1)(b) GDPR; otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

How the transmission works:

• Your input is received by our server function at Vercel in Frankfurt am Main. It is not stored on the website itself, in particular not in a database.
• The server function forwards it as an email to our mailbox via the delivery service Resend. Provider: Plus Five Five, Inc. (“Resend”), 2261 Market Street #5039, San Francisco, CA 94114, USA.
• Our mailbox is hosted on Google Workspace. Provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Your enquiry is kept there like any email you send us directly.

A form field that is invisible to people serves solely to detect automated spam submissions. In the event of technical faults we log only an error code, not the content of your enquiry.

Retention: we delete your details once your enquiry has been dealt with and no further communication about it is expected – as a rule no later than six months after the last message. If the enquiry leads to an order, we keep the business correspondence in accordance with statutory retention obligations (in particular § 147 AO, § 14b UStG); the legal basis for this is Art. 6(1)(c) GDPR.

Providing your details is voluntary. Without your name, email address and message, however, we cannot answer your enquiry.

On the Websites page, you choose your niche and the website features you want. On the Pricing page, you tick routines from your office and see an estimate of what this manual work costs per year, with frequency, team size and hourly rate as adjustable factors. On both pages, your selection is reflected only in the address (URL) of the page and is not stored on your device – neither in cookies nor in local storage. The address contains no contact data; after you submit a request, it additionally contains the request number, so the confirmation page can be reopened via the same link. Like any page request, it is processed in the server log files (see Hosting and server log files). If you have consented to web analytics, PostHog also records your selection under a pseudonym (see Web analytics with PostHog).

Only when you submit a website request or request a free process analysis do we process:

• company, name and email address;
• optionally: phone number and a message or – for the process analysis – what annoys you most;
• for “Other industry” additionally: the industry you named;
• your confirmation that you are submitting the request for your business (entrepreneur within the meaning of § 14 BGB);
• for a website request: the selected niche and the features you want; for a process analysis: the selected routines with frequency, team size, hourly rate and the sum calculated from them;
• the language of the page and a hint as to which page or section you came from; if you have also made a selection on the other page, that selection in short form too – for a website request, the number of routines chosen and the estimated yearly sum; for a process analysis, the industry chosen and the number of features – together with a link to that selection;
• a request number;
• how long the form was open before it was submitted – solely to detect automated requests.

Purpose and legal basis: processing your request and contacting you about it, for a website request including the preparation of a quote (Art. 6(1)(b) GDPR). We base spam detection on our legitimate interest in a working enquiry channel free of abuse (Art. 6(1)(f) GDPR).

Transmission, recipients and retention are the same as for the contact form (see Contact form and email). We do not send any automatic message to the email address you enter; we get back to you personally.

Providing your details is voluntary. However, we need your company, name, email address and your confirmation that you are submitting the request for your business in order to process your request; without these details, no request is possible.

Please do not enter health data in the form’s free-text fields (message / “what annoys you most”, industry). The mention of health data (Art. 9 GDPR) for the “Practice” niche only concerns a possible feature of our customers’ future website, such as a medical-history questionnaire before an appointment – not our own request form. We do not collect health data through this form.

If you consent to web analytics in the banner, we use the analytics service PostHog to understand how visitors use our website and to improve it on that basis. The provider is PostHog, Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA (“PostHog”). We use PostHog’s European instance, PostHog Cloud EU: the data is stored and processed on servers in Frankfurt am Main, Germany.

Without your consent, PostHog is not loaded. No analytics script runs, nothing is stored on your device for this purpose and nothing is transmitted to PostHog. You can use the website without restriction even if you do not consent.

Purposes:

• measuring reach: which pages are viewed how often and how visitors find their way to us;
• click and scroll behaviour, including as heatmaps: which elements are clicked and how far visitors read a page;
• session recordings: a replay of the visit (page changes, mouse movements, clicks, scrolling) to identify usability problems. The recording shows the page as you see it, including a sum calculated on the Pricing page; form input and form content are masked in your browser and not transmitted;
• funnel analysis (conversion funnel): at which steps on the way to an enquiry visitors continue or drop off, for example when choosing a niche and features on the Websites page, routines on the Pricing page, or when submitting a form. For forms, we only record that a form was submitted and whether this succeeded, not its content.

Data processed:

• a randomly generated pseudonymous identifier of your browser and a session identifier;
• pages viewed (address, page title), the previously visited page (referrer), time and duration of the visit – on the Websites and Pricing pages, the address contains your full selection (niche and features, or routines, frequency, team size and hourly rate);
• interactions: clicked elements with their labels, scroll depth, mouse movements, language changes, and, when the Pricing page calculates a sum, a separate analytics event with that sum only as a coarse range (e.g. “€1,000–2,500”) – never your contact details;
• browser, operating system, device type, screen size and language setting;
• approximate location (country, region, city), derived from your IP address.

Your IP address is not stored: the “Discard client IP data” setting is enabled in our PostHog project. PostHog uses the IP address only briefly to determine the approximate location and then discards it. We do not use PostHog to collect names, email addresses, phone numbers or messages from our forms. We analyse the data under a pseudonym, do not attempt to attribute it to individuals and do not combine it with other data about you.

The data reaches PostHog via our own domain (path “/ingest”, forwarded by our host Vercel). Your browser does not connect directly to PostHog’s servers.

Legal basis: your consent – for storing information on your device and accessing it under § 25(1) TDDDG, and for further processing under Art. 6(1)(a) GDPR. Giving consent is voluntary.

Withdrawal: you can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR) via the “Cookie settings” link in the footer of every page. Collection then stops immediately, and PostHog’s cookies and entries are deleted from your browser. This does not affect the lawfulness of processing carried out before the withdrawal.

Cookies and local storage: once you have consented, PostHog creates the following entries in your browser. Their names begin with “ph_” or “__ph_” and contain the public key of our PostHog project:

• a cookie “ph_<project key>_posthog” containing the pseudonymous identifier and the session identifier – lifetime one year;
• an entry of the same name in local storage with PostHog settings – it remains until you withdraw your consent or clear the site data;
• an entry “__ph_opt_in_out_<project key>” in local storage, in which PostHog itself records that you have consented;
• entries in session storage that assign browser tabs to the current session – they are deleted when you close the tab.

Retention: PostHog automatically deletes session recordings 30 days after they were recorded. We analyse usage events (such as page views and clicks) for no longer than one year; PostHog no longer includes older events in analyses but does not delete them automatically. If we stop using web analytics, we delete our PostHog project and with it all data stored in it.

Processing on our behalf and third countries: PostHog processes the data as a processor on our behalf; we have concluded a contract with PostHog for this purpose pursuant to Art. 28 GDPR. Although the data is stored in Frankfurt am Main, access from the USA by PostHog, Inc. or its sub-processors – for example for support or maintenance – cannot be ruled out (see Recipients and transfers to third countries). More information in PostHog’s privacy policy: posthog.com/privacy.

We use cookies and similar technologies that can recognise your device only for web analytics – and only with your consent (see Web analytics with PostHog). We do not use any advertising or marketing tools.

Without your consent, we create at most two entries in your browser’s local storage, each only in response to your own action:

• “ol-consent” – your choice in the banner, i.e. whether you have accepted or declined web analytics, together with a version number and the time. The entry is created when you accept or decline so that your choice is respected and the banner does not reappear on every page. It remains until you change your choice via “Cookie settings” in the footer or clear the site data.
• “ol-theme” – your choice of display if you use the switch in the header to change between light and dark mode (value “light” or “dark”), so that it is kept for your next visit. When a page loads, a small script reads this entry to apply the chosen display without flickering.

Neither entry contains an identifier, and neither is transmitted to us. The legal basis is § 25(2) no. 2 TDDDG: the storage is strictly necessary to provide the function you have expressly requested – respecting your choice in the banner and keeping your chosen display; no consent is required. You can delete the entries at any time in your browser settings (clear site data). The banner will then appear again, and the website will be shown in the default light mode.

The fonts on this website (Geist) are embedded locally and delivered together with the website via Vercel. No connection to third-party servers, such as Google Fonts, is established when a page is loaded.

We do not embed videos, maps, social media plug-ins, chat widgets, captchas or any other third-party content. Links to other websites are ordinary links: you only leave our website when you click such a link. The respective provider is responsible for data processing there.

We only pass on personal data where this is necessary for the purposes described. We do not sell data or pass it on for advertising purposes. The following service providers process data on our behalf (processors within the meaning of Art. 28 GDPR):

• Recipient

  Vercel Inc., USA

  Purpose

  Hosting, delivery of the website, server functions (forms, region Frankfurt am Main)

  Safeguards

  EU-U.S. Data Privacy Framework, standard contractual clauses

  More

  vercel.com/legal/privacy-notice

• Recipient

  Plus Five Five, Inc. (Resend), USA

  Purpose

  Delivering form submissions by email to our mailbox

  Safeguards

  EU-U.S. Data Privacy Framework, standard contractual clauses

  More

  resend.com/legal/privacy-policy

• Recipient

  Google Cloud EMEA Limited (Google Workspace), Ireland

  Purpose

  Email mailbox; a transfer to Google LLC in the USA is possible

  Safeguards

  EU-U.S. Data Privacy Framework, standard contractual clauses

  More

  cloud.google.com/terms/cloud-privacy-notice

• Recipient

  PostHog, Inc., USA

  Purpose

  Web analytics, only with your consent (PostHog Cloud EU, data stored in Frankfurt am Main)

  Safeguards

  EU-U.S. Data Privacy Framework, standard contractual clauses

  More

  posthog.com/privacy

Transfers to third countries: Vercel, Resend and PostHog are based in the USA; access from the USA is also possible at Google. We base transfers to the USA on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which the recipients are certified, and additionally on the EU standard contractual clauses (Art. 46(2)(c) GDPR). A list of certified companies is available at dataprivacyframework.gov/list.

Authorities receive data only where we are legally obliged to provide it.

You have the following rights with regard to us:

• access to your data (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of consent with effect for the future (Art. 7(3) GDPR), for example via “Cookie settings” in the footer,
• objection to processing (Art. 21 GDPR, see Right to object).

An informal message is sufficient to exercise your rights, for example to david@tryoutreachlab.com.

Right to lodge a complaint: you can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany, datenschutz-berlin.de.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. The Pricing page merely calculates a non-binding estimate from your selection; we decide on any quote personally.

This website and your input are transmitted in encrypted form (TLS/HTTPS).

We update this privacy policy when the website or our data processing changes. The version published here applies; the date of the last change is shown at the top of this page.