Controller
The controller for the data processing on this website is Spreat GmbH. The full contact details are in the legal notice.
The same controller is responsible for our sub-sites that run on their own addresses. They point to this policy instead of keeping one of their own - so everything stays in one place.
Hosting
This website is operated on Vercel (Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA). When a page is requested, Vercel processes technically necessary connection data such as IP address, time, requested address and browser identifier in order to deliver the page and to fend off attacks. The legal basis is our legitimate interest in a secure and available service (Art. 6 (1) (f) GDPR).
Images, videos and audio files remain in the Cloudflare R2 object storage (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). They are fetched through this website rather than from Cloudflare directly, so your browser only ever connects to Vercel.
Both providers are based in the United States. Transfers rest on the European Commission's standard contractual clauses, agreed in the respective data processing agreements.
The connection to this website is TLS-encrypted throughout.
Details: Vercel privacy policy and Vercel data processing addendum - for the object storage, the Cloudflare privacy policy and the Cloudflare data processing agreement.
Contact requests
If you use the contact form, we store what you enter in order to handle your request: type of request, name, email address, optionally company, and your message. The legal basis is the initiation or performance of a contractual relationship, or our legitimate interest in answering you (Art. 6 (1) (b) and (f) GDPR).
We also record the time of submission - as proof of when and on what basis you provided us with your details.
The data is held in a database at Supabase (Supabase Pte. Ltd., 65 Chulia Street, OCBC Centre, Singapore) in the Frankfurt am Main data centre (region eu-central-1). Where the provider exceptionally accesses data from outside the EU for operations and support, that access is covered by EU standard contractual clauses. Details: Supabase privacy policy - the processing is based on the Supabase data processing agreement.
Appointment booking
On the booking page we ask for a few details about your store up front: name, email address, name and location of the store, type of store, approximate floor space and optionally a message. We store these details like a contact request - in the same Supabase database in Frankfurt am Main. The legal basis is the initiation of a contractual relationship, or our legitimate interest in preparing the call (Art. 6 (1) (b) and (f) GDPR).
We use HubSpot (HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA) to schedule the call. We transfer your details there so that a contact is created for your request and the appointment can be assigned to it.
The calendar itself is only loaded once you explicitly request it. Before that, no connection to HubSpot exists. By clicking the button that loads the calendar you consent to the transfer - this includes your IP address, your browser identifier and the cookies HubSpot sets for the booking process. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG, the German Telecommunications Digital Services Data Protection Act). It applies to that page view only - on your next visit we ask again. Withdrawing is therefore as simple as consenting: just do not load the calendar again.
HubSpot also processes data in the USA. The transfer is based on the EU-US Data Privacy Framework and, additionally, on standard contractual clauses. Details: HubSpot privacy policy - the processing is based on the HubSpot data processing agreement.
Brand match and product match
The brand match at brand-matching.spreat.com and the product match at product-matching.spreat.com initially run entirely in your browser. You answer three questions about your store, pick product categories and swipe through the cards. As long as you do not submit anything, none of it reaches us.
Only when you submit your contact details at the end do we receive your entries: name, email address, name and location of the store, type of store, approximate floor space, the brands or products you kept, and optionally a message. What you skipped is not transmitted.
We store these details like an appointment request - in the same Supabase database in Frankfurt am Main, with the same twelve-month retention period. The legal basis is the initiation of a contractual relationship, or our legitimate interest in preparing the call (Art. 6 (1) (b) and (f) GDPR).
We also record the time of submission and transfer your details to HubSpot so that a contact is created there for your request. This happens on our servers; your browser does not connect to HubSpot. For more on HubSpot and the transfer to the USA, see appointment booking above.
Campaign pages
Our campaign pages live at store.spreat.com and christmas.spreat.com. If you enter only your email address there, we open HubSpot's booking calendar in a new window and pass the address along as a parameter so that you do not have to type it twice. For that step, what is written under appointment booking above applies - including the transfer to the USA.
If you submit a complete form on a campaign page, we receive the same details as with an appointment request: name, email address, name and location of the store, type of store, approximate floor space and optionally a message. We store them in the same Supabase database in Frankfurt am Main, with the same twelve-month retention period. The legal basis is the initiation of a contractual relationship, or our legitimate interest in preparing the call (Art. 6 (1) (b) and (f) GDPR).
Here too we record the time of submission and transfer your details to HubSpot from our servers, so that a contact is created there for your request.
Email communication
If you send us an email directly, we process your address and the content of the message in order to answer your request (Art. 6 (1) (b) and (f) GDPR). Our mailboxes are operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, as a processor. Details: IONOS privacy policy - the processing is based on the IONOS data processing agreement.
Analytics
With your consent we measure how this website is used - with PostHog in the EU cloud (PostHog, Inc., USA; processing on servers in the EU). The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which we obtain through the prompt on your first visit.
Before you agree, the measurement script is not even loaded - no connection to PostHog is made and no cookies are set. If you decline, we store only that decision itself: a technically necessary cookie called spreat_consent with a lifetime of six months, so that we do not have to ask again on every visit.
If you agree, we record how the website is used: pages viewed and interactions - clicks, submitted forms and the places on the page where they happen -, mouse movements, click positions and scroll depth for heatmaps, technical measurements of loading speed, and error diagnostics if a script error occurs while you use the site. We do not write any names or contact details into the event data ourselves. PostHog then sets its own cookies and storage entries, recognisable by the prefix ph_, with a lifetime of up to twelve months. Individual sessions are recorded as a replay of movement; all form entries are masked in those recordings and are not visible to us. The internal editorial area is not measured.
The measurement data runs through an address on our own domain (spreat.com/relay) and is passed on to PostHog from there - so it does reach PostHog, not only us.
PostHog, Inc. is based in the USA. The transfer is based on the EU-US Data Privacy Framework and, additionally, on EU standard contractual clauses. Details: PostHog privacy policy - the processing is based on the PostHog data processing agreement.
The same consent covers Vercel Web Analytics (Vercel Inc., USA), which counts page views and referrers. It sets no cookies; visits are told apart by a checksum of the request that expires after 24 hours. Without your agreement this script is not loaded either.
Regardless of your decision, Vercel Speed Insights measures how quickly the pages load. It creates no cookies, no entry in your browser and no identifier that could link two page views - what is recorded is the address, connection speed, browser, device type, operating system and your country. The legal basis is our legitimate interest in a fast website (Art. 6 (1) (f) GDPR).
Vercel Inc. is based in the United States. The transfer rests on the standard contractual clauses in the data processing addendum linked above.
You can withdraw your consent at any time with effect for the future: the cookie settings entry in the footer opens the choice again. After a withdrawal the measurement stops and the cookies set by PostHog are deleted.
Erasure
Contact requests, booking requests and requests from the brand match or a campaign page are deleted automatically once they are twelve months old. A clean-up job runs daily in the database for this; no manual step is needed.
If you want to be deleted sooner, an informal message to us is enough.
Protection against misuse
So that our forms cannot be misused for bulk sending, we limit the number of requests per sender and hour. For this we store no IP address, only a non-reversible check value derived from it, which additionally changes every day. Drawing conclusions about individual people is therefore not possible.
The forms also contain a field that is invisible to you and that only automated programs fill in.
What we do not do
- Analytics only with your consent - without it the measurement script is not even loaded.
- No advertising networks, no profiling for advertising purposes, no disclosure for advertising purposes.
- No embedding of Google Fonts or other font services - the fonts are hosted on our own server.
- No cookies for advertising purposes. Statistics cookies only after consent; besides those, only the internal editorial area sets a technically necessary login cookie.
Embedded content
Videos and audio recordings in our stories are held on our own infrastructure and delivered directly. No data is transmitted to video platforms such as YouTube or Vimeo.
The only third-party embed is the HubSpot booking calendar. It loads exclusively after your explicit click; see appointment booking above for details.
Changes to this policy
We adapt this policy when the website or the services it uses change - the version published here at the time applies, recognisable by the version line above. We do not announce substantive changes individually; a look at this page always shows the current state.
Your rights
You have the right to information about the data stored about you, to rectification, erasure and restriction of processing, to data portability, and to object to processing based on a legitimate interest. You can withdraw consent you have given at any time with effect for the future.
A message to hello@spreat.com is enough for all of these requests.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information.