enaudo logo enaudo

Site map

Privacy policy

Preamble

This privacy policy explains which types of personal data (hereinafter also “data”) we process, for which purposes and to what extent. It applies to all processing of personal data we carry out, both in providing our services and in particular on our websites, in mobile applications and in external online presences such as social-media profiles (hereinafter collectively the “online offering”). The terms used are gender-neutral.

Last updated: 2 May 2026

Controller

Leonardo Scharl
Britzer Damm 107
12347 Berlin
Email: info@enaudo.de
Legal notice: enaudo.de/en/impressum

Overview of processing

The following overview summarises the types of data processed, the purposes of processing, and the categories of data subjects.

Types of data processed

  • Master data (e.g. names, addresses).
  • Contact data (e.g. email, telephone numbers).
  • Content data (e.g. entries in online forms).
  • Usage data (e.g. pages visited, interest in content, access times).
  • Meta, communication and procedural data (e.g. IP addresses, timestamps).

Categories of data subjects

  • Communication partners.
  • Users (e.g. website visitors).

Purposes of processing

  • Security measures.
  • Providing our online offering and usability.
  • IT infrastructure.
  • Contact enquiries and communication.
  • Appointment management.

Relevant legal bases

Relevant legal bases under the GDPR: below is an overview of the GDPR legal bases on which we process personal data. Please note that, in addition to the GDPR, national data-protection rules may apply in your or our country of residence or establishment.

  • Consent (Art. 6(1) sentence 1 lit. a GDPR) — the data subject has given consent to the processing of their personal data for one or more specific purposes.
  • Performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 lit. b GDPR) — processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legal obligation (Art. 6(1) sentence 1 lit. c GDPR) — processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR) — processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

National data-protection rules in Germany: in addition to the GDPR, national data-protection rules apply in Germany, in particular the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG).

Security measures

In accordance with legal requirements, taking into account the state of the art, implementation costs and the nature, scope, circumstances and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to it. Securing online connections with TLS/SSL encryption (HTTPS) is mandatory.

Transfer of personal data

In the course of processing personal data, data may be transferred to or disclosed to other bodies, companies, legally independent organisational units or persons. In such cases we comply with legal requirements and in particular conclude corresponding contracts or agreements.

International data transfers

For transfers to the USA we primarily rely on the Data Privacy Framework (DPF), which has been recognised as a secure legal framework by an adequacy decision of the European Commission. In addition we have concluded Standard Contractual Clauses with the respective providers that meet the requirements of the European Commission.

General information on storage and deletion

We delete personal data that we process in accordance with legal requirements as soon as the underlying consents are withdrawn or there are no further legal bases for processing. Where retention obligations apply, we follow German commercial and tax retention periods (6 to 10 years).

Rights of data subjects

Rights of data subjects under the GDPR: as a data subject you have various rights under the GDPR, in particular from Art. 15 to 21 GDPR (access, erasure, objection, rectification, withdrawal of consent).

Provision of the online offering and web hosting

We process users’ data in order to provide our online services. Our website uses services of Bunny.net (BunnyWay d.o.o.).

  • Types of data processed: usage data; meta, communication and procedural data.
  • Data subjects: users.
  • Purposes of processing: providing our online offering and usability.
  • Legal bases: legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further notes on processing operations, procedures and services:

  • Bunny.net: hosting, DNS infrastructure and content delivery network (CDN). The provider acts as a host and filter between users and our server to secure the website and optimise load times. Processing by Bunny.net is covered by a data processing addendum; Provider: BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia; Website: https://bunny.net/; Privacy policy: https://bunny.net/privacy/; Basis for third-country transfers: as the provider is established in the EU, there is in principle no third-country transfer.

Email communication

If you contact us by email, the personal data you send is stored automatically. Data transmitted to us on a voluntary basis is stored for the purpose of processing the enquiry or contacting the data subject.

  • Types of data processed: master data (e.g. names, addresses); contact data (e.g. email, telephone numbers); content data (e.g. text in emails, documents); meta, communication and procedural data.
  • Data subjects: communication partners, prospects, customers.
  • Purposes of processing: contact enquiries and communication.
  • Legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 lit. b GDPR), legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Email infrastructure provider:

Contact enquiries and webhooks (Hetzner, UpCloud, Scaleway)

When users complete the contact form on our website, we process the data entered to handle the enquiry. Data sent via the contact form is transmitted securely via a webhook to our automation software and stored in a database. Backups are created regularly to protect the data.

Specific privacy note: this infrastructure is hosted on servers of European providers. The data is not transferred to other unauthorised third parties in third countries outside the EU/EEA.

Spam protection: to protect our forms against automated spam and denial-of-service attacks we use a self-hosted proof-of-work mechanism (ALTCHA) directly on our server infrastructure. In the background your browser solves a short mathematical challenge to verify human input. No cookies are set, no tracking or profiling mechanisms are used, and no data is transferred to external third parties (legal basis: Art. 6(1) sentence 1 lit. f GDPR to ensure IT security and defend against abusive requests).

  • Types of data processed: master data (e.g. name, company); contact data (e.g. email address, telephone number); content data (e.g. message, budget, source); meta, communication and procedural data.
  • Data subjects: users (prospects, communication partners).
  • Purposes of processing: contact enquiries and communication; initiation of a contract; data backup.
  • Legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 lit. b GDPR), legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Providers of server infrastructure and databases:

Appointment booking (Cal.com)

To arrange appointments (e.g. introductory calls) we use the online booking tool “Cal.com”.

Specific privacy note (two-click solution): to protect your data, the Cal.com booking widget is disabled by default and does not connect to Cal.com’s servers when our website is merely loaded. Only when you actively click the “Book an intro call” button (or tap twice on mobile devices) is the external script loaded and the booking window opened. Your IP address is then transmitted to Cal.com so the widget can be displayed on your screen.

If you book an appointment, the data you enter is processed for appointment management.

  • Types of data processed: master data (e.g. name); contact data (e.g. email address); content data (e.g. appointment details); meta and procedural data (e.g. IP addresses when the widget is loaded).
  • Data subjects: users (prospects, communication partners).
  • Purposes of processing: arranging appointments, internal organisation, pre-contractual communication.
  • Legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 lit. b GDPR); consent (Art. 6(1) sentence 1 lit. a GDPR) for loading the external content through your click.

Further notes on processing:

  • Cal.com: software for online appointment booking; Provider: Cal.com, Inc., 548 Market St, San Francisco, CA 94104, USA; Website: https://cal.com/; Privacy policy: https://cal.com/privacy; Basis for third-country transfers: Data Privacy Framework (DPF) / Standard Contractual Clauses.

Use of cookies

We use cookies and comparable storage technologies in accordance with legal requirements. Whether we process personal data using cookies depends on consent. Without consent we rely on our legitimate interests as explained in this section and in the context of the respective services. Essential technologies include those that are strictly necessary to provide the online offering and its technical functionality (functional / always active).

The language preference stored after you choose German or English is kept in local storage on your device so we can show the matching version on later visits. This is strictly necessary for the language feature.

Changes and updates

Please review the content of this privacy policy regularly. We adapt it as soon as changes to the processing we carry out make this necessary.