Controller
The controller for the data processing on this website is Spreat GmbH. The full contact details are in the legal notice.
The same controller is responsible for our sub-sites that run on their own addresses. They point to this policy instead of keeping one of their own - so everything stays in one place.
Hosting
This website is operated on Vercel (Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA). When a page is requested, Vercel processes technically necessary connection data such as IP address, time, requested address and browser identifier in order to deliver the page and to fend off attacks. The legal basis is our legitimate interest in a secure and available service (Art. 6 (1) (f) GDPR).
Images, videos and audio files remain in the Cloudflare R2 object storage (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). They are fetched through this website rather than from Cloudflare directly. The exception is the logos and product images in the Brandpool preview on the home page and the brands page: your browser loads them directly from img.spreat.cloud, the image server of our Brandpool platform, which also runs on Cloudflare. Cloudflare thereby learns your IP address and browser identifier.
Both providers are based in the United States. Transfers rest on the European Commission's standard contractual clauses, agreed in the respective data processing agreements.
The connection to this website is TLS-encrypted throughout.
Details: Vercel privacy policy and Vercel data processing addendum - for the object storage, the Cloudflare privacy policy and the Cloudflare data processing agreement.
Contact requests
If you use the contact form, we store what you enter in order to handle your request: type of request, name, email address, optionally company, and your message. The legal basis is the initiation or performance of a contractual relationship, or our legitimate interest in answering you (Art. 6 (1) (b) and (f) GDPR).
We also record the time of submission - as proof of when and on what basis you provided us with your details.
The data is held in a database at Supabase (Supabase Pte. Ltd., 65 Chulia Street, OCBC Centre, Singapore) in the Frankfurt am Main data centre (region eu-central-1). Where the provider exceptionally accesses data from outside the EU for operations and support, that access is covered by EU standard contractual clauses. Details: Supabase privacy policy - the processing is based on the Supabase data processing agreement.
Appointment booking
On the booking page we ask for a few details about your store up front: name, email address, name and location of the store, type of store, approximate floor space and optionally a message. We store these details like a contact request - in the same Supabase database in Frankfurt am Main. The legal basis is the initiation of a contractual relationship, or our legitimate interest in preparing the call (Art. 6 (1) (b) and (f) GDPR).
We use HubSpot (HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA) to schedule the call. We transfer your details there so that a contact is created for your request and the appointment can be assigned to it.
The calendar itself is only loaded once you explicitly request it. Before that, no connection to HubSpot exists. By clicking the button that loads the calendar you consent to the transfer - this includes your IP address, your browser identifier and the cookies HubSpot sets for the booking process. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG, the German Telecommunications Digital Services Data Protection Act). It applies to that page view only - on your next visit we ask again. Withdrawing is therefore as simple as consenting: just do not load the calendar again.
HubSpot also processes data in the USA. The transfer is based on the EU-US Data Privacy Framework and, additionally, on standard contractual clauses. Details: HubSpot privacy policy - the processing is based on the HubSpot data processing agreement.
Brand match and product match
The brand match at brand-matching.spreat.com and the product match at product-matching.spreat.com initially run entirely in your browser. You answer three questions about your store, pick product categories and swipe through the cards. As long as you do not submit anything, none of it reaches us.
Only when you submit your contact details at the end do we receive your entries: name, email address, name and location of the store, type of store, approximate floor space, the brands or products you kept, and optionally a message. Added to that are the language of the page and, if you came through a tagged link, its campaign tag - for example, that the link sat in the menu of spreat.com. What you skipped is not transmitted.
We store these details like an appointment request - in the same Supabase database in Frankfurt am Main, with the same twelve-month retention period. The legal basis is the initiation of a contractual relationship, or our legitimate interest in preparing the call (Art. 6 (1) (b) and (f) GDPR).
We also record the time of submission and transfer your details to HubSpot so that a contact is created there for your request. This happens on our servers; your browser does not connect to HubSpot. For more on HubSpot and the transfer to the USA, see appointment booking above.
Everything else is as described under Hosting and Analytics: both match tools run on Vercel too and are measured by Vercel Web Analytics and Speed Insights. In addition, we use PostHog in the EU cloud (PostHog, Inc., USA) to count how many visits reach which step - from the start through the questions and the card stack to the request and the opened calendar. This count runs without cookies: no cookies are set and nothing is stored in your browser, no profile is built, and we transmit neither names nor contact details - only the step, the language of the page, the campaign tag of the link and numbers such as how many brands or products were kept. To tell visits apart, PostHog forms a checksum from the IP address and browser details on its servers, using a key that changes daily. The legal basis is our legitimate interest in understanding where visitors drop off (Art. 6 (1) (f) GDPR); you can object to this at any time. For the transfer to the USA, what is said about PostHog under Analytics below applies. These pages carry no consent prompt and no statistics cookies.
Campaign pages
Our campaign pages live at store.spreat.com, christmas.spreat.com and brand.christmas.spreat.com. If you enter your email address there and send it, we store it together with the time of sending in the same Supabase database in Frankfurt am Main, with the same twelve-month deletion period. The identifiers of the ad that brought you are only stored if you agreed to the message to Meta - see Ads on the campaign pages. On store.spreat.com and christmas.spreat.com HubSpot's booking calendar then appears below it in the same card; we pass your address along so that you do not have to type it twice. Nothing of HubSpot is loaded before that - the connection is only made when you send the form, and HubSpot then also learns your IP address. If you actually book a slot, HubSpot only tells us that a booking happened; who booked is not part of that message. For that step, what is written under appointment booking above applies - including the transfer to the USA. On brand.christmas.spreat.com there is no booking: after sending, a link takes you to the registration in the Brandpool (brandpool.spreat.com); we pass the campaign tags you arrived with (UTM parameters) along in that link so we can attribute the registration to the campaign. HubSpot is not loaded on that page.
If you submit a complete form on a campaign page, we receive the same details as with an appointment request: name, email address, name and location of the store, type of store, approximate floor space and optionally a message. We store them in the same Supabase database in Frankfurt am Main, with the same twelve-month retention period. The legal basis is the initiation of a contractual relationship, or our legitimate interest in preparing the call (Art. 6 (1) (b) and (f) GDPR).
Here too we record the time of submission and transfer your details to HubSpot from our servers, so that a contact is created there for your request.
Otherwise what is written under Hosting and Analytics applies here as well: the campaign pages also run on Vercel and are measured by Vercel Web Analytics and Speed Insights. All three campaign pages additionally run PostHog to the extent described under Analytics, each through an address on its own domain (store.spreat.com/relay, christmas.spreat.com/relay and brand.christmas.spreat.com/relay). The same consent we obtain there also covers the message to Meta; both are described below under Ads on the campaign pages. Without your agreement neither is loaded. There, your decision is not kept in spreat.com's spreat_consent cookie but in spreat_meta_consent; you can change it via the entry Einwilligung ändern in the footer of the campaign pages.
Commission calculator
The commission calculator at calculator.spreat.com does all its arithmetic in your browser. Your entries live in the address bar so that you can pass a finished calculation on as a link - they never reach us. There are no forms there, no consent prompt and no connection to any third party.
One single thing is stored in your browser: if you pick another language in the top right, a cookie remembers that choice (`spreat_locale`, one year), so the entry page does not sort you anew on every visit. It holds nothing but the language code, is only created by your click, and is necessary for operation - which is why it needs no consent (§ 25 (2) no. 2 TDDDG). Delete it in your browser and the site goes back to following your browser's language setting.
Everything else is as described under Hosting and Analytics: the calculator runs on Vercel too and is measured by Vercel Web Analytics and Speed Insights.
Email communication
If you send us an email directly, we process your address and the content of the message in order to answer your request (Art. 6 (1) (b) and (f) GDPR). Our mailboxes are operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, as a processor. Details: IONOS privacy policy - the processing is based on the IONOS data processing agreement.
Analytics
With your consent we measure how this website is used - with PostHog in the EU cloud (PostHog, Inc., USA; processing on servers in the EU). The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which we obtain through the prompt on your first visit.
Before you agree, the measurement script is not even loaded - no connection to PostHog is made and no cookies are set. If you decline, we store only that decision itself: a technically necessary cookie called spreat_consent with a lifetime of six months, so that we do not have to ask again on every visit.
If you agree, we record how the website is used: pages viewed and interactions - clicks, submitted forms and the places on the page where they happen -, mouse movements, click positions and scroll depth for heatmaps, technical measurements of loading speed, and error diagnostics if a script error occurs while you use the site. We do not write any names or contact details into the event data ourselves. PostHog then sets its own cookies and storage entries, recognisable by the prefix ph_, with a lifetime of up to twelve months. Individual sessions are recorded as a replay of movement; all form entries are masked in those recordings and are not visible to us. The internal editorial area is not measured.
The measurement data runs through an address on our own domain (spreat.com/relay) and is passed on to PostHog from there - so it does reach PostHog, not only us.
PostHog, Inc. is based in the USA. The transfer is based on the EU-US Data Privacy Framework and, additionally, on EU standard contractual clauses. Details: PostHog privacy policy - the processing is based on the PostHog data processing agreement.
Regardless of your decision, Vercel Web Analytics (Vercel Inc., USA) counts page views and referrers. It sets no cookies and stores nothing in your browser; separate visits are told apart by a checksum of the request that is built on the server and expires after 24 hours - recognition beyond that day is not possible. Because no access to your device is involved, § 25 TDDDG does not apply; the legal basis is our legitimate interest in audience measurement (Art. 6 (1) (f) GDPR), which you may object to at any time.
On the same basis, Vercel Speed Insights measures how quickly the pages load. It creates no cookies, no entry in your browser and no identifier that could link two page views - what is recorded is the address, connection speed, browser, device type, operating system and your country. The legal basis is our legitimate interest in a fast website (Art. 6 (1) (f) GDPR).
Vercel Inc. is based in the United States. The transfer rests on the standard contractual clauses in the data processing addendum linked above.
You can withdraw your consent at any time with effect for the future: the cookie settings entry in the footer opens the choice again. After a withdrawal the measurement stops and the cookies set by PostHog are deleted.
Ads on the campaign pages
For the campaign pages at store.spreat.com, christmas.spreat.com and brand.christmas.spreat.com we run ads on Meta, that is on Facebook and Instagram. If you request an appointment there or sign up as a brand, we tell Meta Platforms Ireland Ltd. - with your consent - that an ad turned into an enquiry. The legal basis is your consent (Art. 6 (1) (a) GDPR), which we obtain on those pages before anything is transmitted.
The message travels on two paths that describe the same event. From our server through Meta's Conversions API; what is transmitted there is your email address as an irreversible hash (SHA-256) and never in plain text, the click id of the ad you arrived through, the id of your browser from the _fbp cookie where the pixel has set one, our own visitor id from the spreat_vid cookie, your IP address and what your browser reports about its type, version and operating system (user agent), the address of the campaign page you enquired on, and the time and type of the event.
The second path is the Meta pixel in your browser. It is only loaded after you have agreed - before that no connection to Meta is made. It then sets two cookies on our own domain: _fbp as an identifier for your browser and, if you arrived through an ad, _fbc holding its click id. Both expire after 90 days. In addition we set our own cookie spreat_vid holding a random visitor id, also for 90 days; the pixel passes it to Meta as an external id so that the page view, the enquiry and the appointment are attributed to the same visit. The id does not reveal who you are. Because this accesses your device, this path additionally rests on § 25 (1) TDDDG.
Both paths carry the same event id, so that Meta merges them into one event instead of counting it twice.
Without your agreement neither path happens: the pixel is not loaded, no _fbp, _fbc or spreat_vid cookies come into being, and nothing goes from our server to Meta either. The ad's click id and the visitor id are then not stored either, because without the message they serve no purpose. We remember your decision in a cookie called spreat_meta_consent with a lifetime of six months; the entry Einwilligung ändern in the footer of the campaign pages reopens the choice. If you withdraw, we delete the cookies Meta has set and spreat_vid and do not load the pixel again.
For the processing after the transfer, we and Meta Platforms Ireland Ltd. are joint controllers insofar as Meta uses the data for its own purposes. Meta also processes in the USA; the transfer rests on the EU-US Data Privacy Framework and, additionally, on standard contractual clauses. Details: Meta privacy policy.
Erasure
Contact requests, booking requests and requests from the brand match, the product match or a campaign page are deleted automatically once they are twelve months old. A clean-up job runs daily in the database for this; no manual step is needed.
If you want to be deleted sooner, an informal message to us is enough.
Protection against misuse
So that our forms cannot be misused for bulk sending, we limit the number of requests per sender and hour. For this we store no IP address, only a non-reversible check value derived from it, which additionally changes every day. Drawing conclusions about individual people is therefore not possible.
With every request we also store your browser's type, version and operating system (user agent), so that automated or abusive submissions can be recognised. It is deleted together with the request. The legal basis is our legitimate interest in working forms (Art. 6 (1) (f) GDPR).
The forms also contain a field that is invisible to you and that only automated programs fill in.
What we do not do
- No measurement with cookies or recognition without your consent: on spreat.com, PostHog is not even loaded without it. On the brand match and product match, PostHog only runs as a cookieless count without a profile - described under Brand match and product match. Vercel's cookieless counting runs independently of that - described under Analytics above, with a right to object.
- No advertising networks and no ad tracking on spreat.com itself. The exception is our campaign pages: only there, and only with your consent, do we report to Meta that an ad turned into a request - described under Ads on the campaign pages. We do not sell data and do not build advertising profiles ourselves.
- No embedding of Google Fonts or other font services - the fonts are hosted on our own server.
- Cookies for advertising purposes (_fbp, _fbc and spreat_vid) only on the campaign pages and only after consent; statistics cookies likewise only after consent. Besides those, we only set the technically necessary cookies described above - for your consent decision and your chosen language - and a login cookie in the internal editorial area.
Embedded content
Videos and audio recordings in our stories are held on our own infrastructure and delivered directly. No data is transmitted to video platforms such as YouTube or Vimeo.
On spreat.com, the only third-party embed is the HubSpot booking calendar. It loads exclusively after your explicit click; see appointment booking above for details. On store.spreat.com and christmas.spreat.com the calendar appears after you send your email address, and with your consent the campaign pages load the Meta pixel - both are described above under Campaign pages and Ads on the campaign pages.
Changes to this policy
We adapt this policy when the website or the services it uses change - the version published here at the time applies, recognisable by the version line above. We do not announce substantive changes individually; a look at this page always shows the current state.
Your rights
You have the right to information about the data stored about you, to rectification, erasure and restriction of processing, to data portability, and to object to processing based on a legitimate interest. You can withdraw consent you have given at any time with effect for the future.
A message to hello@spreat.com is enough for all of these requests.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information.