Privacy Policy

This is a convenience translation. In case of discrepancies, the German version prevails.

This privacy policy explains which personal data we process when you visit our website codestryke.com or get in touch with us, for what purposes and on what legal basis this takes place, and which rights you have. We use terms such as “personal data”, “processing” or “processor” as defined in Art. 4 of the General Data Protection Regulation (GDPR).

Contents

1. Controller

The controller responsible for the processing of personal data on this website is:

codestryke GmbH
Jahnstraße 23
89168 Niederstotzingen
Germany

Represented by the managing directors Benedikt Miller, Kai Schwetz, Patrick Kopp and Philipp Mayer.

Phone: +49 (0) 89 21528775
Email: [email protected]

For questions about data protection and to exercise your rights, you can reach us using these contact details, most easily by email.

2. The key points at a glance

  • This website does not set cookies and does not use any analytics, tracking or marketing services.
  • We do not embed any third-party content. The typeface and the videos are stored with our hosting provider and are only loaded from there. The only exception is the Calendly scheduling calendar on the contact page – it is only loaded if you expressly request it with a click.
  • When you access the website, our hosting provider Cloudflare processes technically necessary access data (server log files); this may involve a transfer to the USA (section 3).
  • If you email or call us or book an appointment, we process your details in order to handle your request. We receive and process our emails with Google Workspace, and we manage business contacts in the CRM system Pipedrive.

3. Hosting, server log files and encryption

Hosting

This website is hosted by:

Cloudflare, Inc.
101 Townsend Street
San Francisco, CA 94107
USA

With its Cloudflare Pages service, Cloudflare provides the servers on which the files of this website are stored and delivers them via a globally distributed network of data centers. As a rule, your request is answered by a data center near you. In doing so, Cloudflare processes the access data described below, also to protect the website against overload and attacks. Cloudflare acts for us as a processor on the basis of a data processing agreement pursuant to Art. 28 GDPR (Data Processing Addendum) and processes the data only in accordance with our instructions.

Data may also be transferred to and processed in the USA and other countries outside the European Economic Area. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework. In this respect, an adequacy decision of the European Commission of July 10, 2023 exists for the USA (Art. 45 GDPR). In addition, the standard contractual clauses of the European Commission apply (Art. 46(2)(c) GDPR), which are part of the Data Processing Addendum. Further information can be found in the Data Processing Addendum and in Cloudflare’s privacy policy.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, reliable and efficient provision of our website.

Server log files

Each time a page or file of this website is accessed, your browser automatically transmits information to the servers of our hosting provider. This information is stored in log files (server log files):

  • IP address of the requesting device
  • date and time of access
  • page or file accessed (URL)
  • website from which the access is made (referrer URL)
  • browser and operating system used (user agent)
  • status code of the request and amount of data transferred

This data is required to deliver the website to your device, to ensure its stable and secure operation and to detect, prevent and investigate attacks or misuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest arises from these purposes.

We do not evaluate the log files to create usage profiles and do not combine them with other data. We only inspect them for a specific reason, for example in the event of technical faults or indications of an attack. The log files are only stored for as long as is necessary for these purposes and are then deleted. Data required to investigate a specific security incident is retained until the investigation has been completed.

Encryption

This website is delivered exclusively via an encrypted connection (TLS). You can recognize this by “https://” in the address bar of your browser. Data that you transmit to us, for example your entries in a form, is thus protected against being read by third parties during transmission.

4. No cookies, no tracking, no third-party content

This website does not set cookies. We do not use any analytics, tracking or marketing services and do not embed social media plugins, map services, video platforms or other third-party content. When you visit our pages, your browser therefore only connects to the servers of our hosting provider (section 3). The only exception is the optional online appointment booking on the contact page: you load the Calendly calendar yourself with a click (section 5).

Typeface

This website uses the THICCCBOI typeface. The font files are stored with our hosting provider and are only loaded from there. No connection is made to font services such as Google Fonts or Adobe Fonts.

Videos

The explainer videos on the AI Operator and Urban Data Add-on pages are stored as files with our hosting provider. They are only loaded when you start playback and are played directly from there. As with every request, only the access data mentioned in section 3 is processed.

5. Online appointment booking with Calendly

This website does not contain any contact forms. For an initial call, you can book an appointment with us directly via the Calendly service. The provider is Calendly, LLC, based in Atlanta, USA (“Calendly”). The calendar is not embedded automatically: only when you click “Load calendar” does your browser access Calendly’s booking page. In doing so, your IP address and technical access data are transmitted to Calendly, and Calendly may use cookies or similar technologies. According to our review (as of October 2026), Calendly’s booking page also loads further services, including from Google (Analytics, Tag Manager, reCAPTCHA), Meta, Stripe and Segment. We have no influence on this; details are given in Calendly’s privacy policy. On the AI Operator and Urban Data Add-on pages and via the “Open in a new tab” link, a simple link leads to Calendly’s booking page; Calendly then only processes your data once you open this link. Alternatively, you can reach us by email or phone.

If you book an appointment, Calendly processes the data you enter, usually your name, email address, the selected appointment and, if applicable, your message, and forwards the booking to us. Calendly processes this data as a processor on the basis of a data processing agreement pursuant to Art. 28 GDPR. The data is processed in the USA. Calendly, LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); in addition, the standard contractual clauses of the European Commission apply (Art. 46(2)(c) GDPR). Further information can be found in Calendly’s privacy notice.

The legal basis for loading the calendar is the consent you give by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time with effect for the future, for example by reloading the page and not opening the calendar again. The legal basis for the appointment booking itself is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR. We delete booked appointments as soon as they are no longer required to handle your request.

6. Email and phone, Google Workspace, Pipedrive

If you email or call us, we process the data you provide, for example your name, your contact details and the content of your request, in order to handle your request. If your request is aimed at concluding or performing a contract, the legal basis is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in handling and answering the requests addressed to us. We delete requests as soon as they have been dealt with conclusively and no further exchange is to be expected, unless statutory retention obligations prevent this (section 10).

Google Workspace

We use Google Workspace for our email communication. This applies to all codestryke mailboxes, including [email protected] and [email protected]. For customers in Germany, the contractual partner and provider is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (“Google”). Google processes the data as a processor on the basis of the data processing terms for Google Cloud services (Cloud Data Processing Addendum) pursuant to Art. 28 GDPR and only on our behalf.

Data may also be transferred to and processed by Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework. In this respect, an adequacy decision of the European Commission of July 10, 2023 exists for the USA (Art. 45 GDPR). Insofar as a transfer is not covered by it, Google bases the transfer on the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). Further information can be found in the Cloud Data Processing Addendum and in the Data Privacy Framework List.

The legal basis for using Google Workspace is Art. 6(1)(f) GDPR. Our legitimate interest lies in a reliable, secure and up-to-date email infrastructure.

Customer relationship management with Pipedrive

We manage inquiries from prospects, customers and partners, and the business contacts resulting from them, in the CRM system Pipedrive. For this purpose, we transfer the details from your inquiry, such as your name, employer or institution, job title, email address, phone number and the content of your request, as well as the further course of our communication and appointments, to Pipedrive. We do not transfer job applications to Pipedrive.

The provider is Pipedrive OÜ, Tallinn, Estonia (“Pipedrive”). Pipedrive processes the data as a processor on the basis of a data processing agreement pursuant to Art. 28 GDPR and only on our behalf. For its operations, Pipedrive uses data centers of Amazon Web Services, among others, as well as further sub-processors; a transfer to third countries, in particular to the USA, cannot be ruled out. Such a transfer takes place on the basis of the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR) and, insofar as Pipedrive Inc. is involved, the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Further information can be found in Pipedrive’s privacy notice and in the list of sub-processors.

The legal basis is Art. 6(1)(b) GDPR insofar as your inquiry is aimed at a contract or a contract exists, otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in the orderly and traceable management of our business relationships. We store the data for as long as the business relationship exists or further exchange is to be expected and then delete it, unless statutory retention obligations prevent this. You can object to this processing at any time (section 12).

7. Job applications

We accept applications by email to [email protected]. There is no application form on this website. We process the data you send us with your application, for example contact details, CV, information on education and professional experience, and links to profiles or code repositories, exclusively to carry out the application process. Only the persons involved in the selection have access. The emails are stored in Google Workspace (section 6).

The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into an employment relationship) in conjunction with § 26(1) of the German Federal Data Protection Act (BDSG), insofar as this provision is applicable under Art. 88 GDPR. If you voluntarily provide us with special categories of personal data, for example information about a severe disability, we process them on the basis of Art. 9(2)(b) GDPR in conjunction with § 26(3) BDSG.

If an employment relationship is established, we continue to process the data for its performance. Otherwise, we usually delete your application documents six months after the end of the application process. Until then, we retain them in order to be able to defend ourselves against possible claims, for example under the German General Equal Treatment Act (AGG) (Art. 6(1)(f) GDPR). Longer storage, for example to consider you for future vacancies, only takes place with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.

This website contains simple links to third-party services, in particular to our profile on LinkedIn, to Google Maps (“Plan your route” on the contact page), to a public code repository on GitLab (Urban Data Add-on page) and, in blog articles and references, to other websites. These are not embedded plugins: no data is transmitted to these providers when you access our pages.

Only when you click on such a link does your browser access the website of the respective provider. As a rule, it only transmits our domain as the referring address. The provider processes your data, at least your IP address and the access data, under its own responsibility. Its privacy notices apply, for example those of LinkedIn, Google and GitLab.

9. Recipients and transfers to third countries

Within codestryke, only those persons who need your data for the respective task have access to it. For the processing operations described in this privacy policy, we use the following processors: Cloudflare (hosting, section 3), Google (email, section 6), Pipedrive (CRM, section 6) and – if you load the scheduling calendar – Calendly (appointment booking, section 5). Beyond that, we only pass on your data if we are legally obliged to do so, for example to authorities, or if this is necessary to establish, exercise or defend legal claims. We do not sell data and do not pass it on for advertising purposes.

In the course of these processing operations, data may only be transferred to countries outside the European Economic Area within the scope of hosting with Cloudflare, Google Workspace, Pipedrive and Calendly. The safeguards for this are described in sections 3, 5 and 6.

10. Storage period

Unless a more specific storage period is stated in this privacy policy, we only store personal data for as long as is necessary for the respective purpose. We then delete it, unless statutory retention obligations prevent this, in particular under § 257 of the German Commercial Code (HGB) and § 147 of the German Fiscal Code (AO), with periods of up to ten years. In this case, we restrict processing to storage and delete the data once the period has expired.

11. Your rights

You have the following rights vis-à-vis us with regard to the personal data concerning you:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR, see section 12)
  • Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of the processing carried out before the withdrawal remains unaffected.

To exercise your rights, an informal message to [email protected] or to our postal address in section 1 is sufficient.

12. Right to object

Insofar as we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

If your data is processed for direct marketing purposes, you can object to this processing at any time without giving reasons (Art. 21(2) GDPR). Your data will then no longer be processed for this purpose.

No particular form is required for the objection; the easiest way is an email to [email protected].

13. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR (Art. 77 GDPR). You can contact any supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for our registered office in Baden-Württemberg is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
(State Commissioner for Data Protection and Freedom of Information Baden-Württemberg)
Heilbronner Straße 35
70191 Stuttgart
Postal address: Postfach 10 29 32, 70025 Stuttgart
Email: [email protected]
www.baden-wuerttemberg.datenschutz.de

14. Provision of data, no automated decision-making

You are neither legally nor contractually obliged to provide us with personal data. Without the access data described in section 3, the website cannot technically be delivered to your device. To book an appointment via Calendly, we need your name and email address; however, you can also reach us by email or phone at any time.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

15. Changes to this privacy policy

We adapt this privacy policy when our website or the processing of personal data changes. The version currently published on this page applies.

Last updated: November 2026