DataClue GmbH

Privacy policy

Draft: Legally pre-checked on 20 October 2026, not legal advice. Final legal sign-off is still pending.

In short: this website sets no cookies and reads nothing from your device for statistics, so there is no cookie banner. Pages, fonts and images are delivered through Cloudflare; no third-party content is loaded when you open a page. Exceptions: interactive Power BI reports and the booking calendar (Microsoft Bookings), which load only after you click, and the Cloudflare Turnstile spam protection, which loads only when you fill in the contact form. The contact form sends your inquiry to us as an email; it is stored only in our mailbox.

1. Controller

DataClue GmbH, represented by its Managing Director Robin Eckardt
Bavariafilmplatz 8, 82031 Grünwald, Germany
[email protected] · +49 89 9542 864-30

2. Data protection contact

Please send data protection questions to [email protected]. We are not required to appoint a data protection officer, as fewer than 20 persons at our company are regularly engaged in the automated processing of personal data (Section 38(1) BDSG) and none of the conditions of Art. 37 GDPR apply.

3. Hosting and delivery (Cloudflare)

The website is provided through Cloudflare Pages by Cloudflare, Inc. (USA) and delivered through its network. When you visit it, Cloudflare processes technically required connection data such as IP address, time, requested address, referrer and browser information to deliver the pages and protect the website against attacks. The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR). Cloudflare processes the data as a processor; this may involve a transfer to the USA, based on Cloudflare’s certification under the EU-US Data Privacy Framework (Art. 45 GDPR) and additionally on standard contractual clauses (Art. 46 GDPR).

The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. We have concluded a data processing agreement with Cloudflare (Art. 28 GDPR). The connection to the website is encrypted with TLS. We ourselves receive no logs containing IP addresses, only aggregated access statistics. Cloudflare stores connection data only for as long as is necessary for delivery and for defending against attacks, and then deletes or anonymises it.

4. Access statistics and click counting

To understand which pages are read, we evaluate Cloudflare’s access statistics. They are generated on the server from the data your browser transmits anyway when it requests a page (requested page, time, referrer, browser type, country of origin). No script is executed for this and nothing is stored on or read from your device. We only see aggregated figures, not individual persons. In addition, we count which entry points are used, for example which of the six situations on the homepage is clicked. When you click such a link, your browser sends only the name of the link and the page you are on to our server function at Cloudflare (see hosting), which increments a counter. We store neither your IP address nor browser data or identifiers, set no cookies and place nothing on your device. In both cases the legal basis is our legitimate interest in designing the website according to need (Art. 6(1)(f) GDPR).

5. No cookies

We use no cookies and no advertising or social media services. If you choose the light or dark display, your browser stores this choice locally (localStorage) so that it is kept on your next visit. This is strictly necessary for the function you have requested (Section 25(2) no. 2 TDDDG). The setting is not transmitted to us and can be deleted in your browser settings.

6. Interactive Power BI reports (after a click)

On our case studies page you can view interactive reports provided through Microsoft Power BI (“Publish to web”). A report is loaded only when you request it with a click (two-click solution); before that, no connection to Microsoft is established. After the click, your browser connects to servers of Microsoft (Microsoft Corporation, USA, or Microsoft Ireland Operations Limited, Ireland). This processes your IP address and browser data; Microsoft may also set cookies or use similar technologies. The legal basis is the consent you give with the click (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). For any transfers to the USA we rely on Microsoft Corporation’s certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and additionally on EU standard contractual clauses. You can withdraw your consent at any time by not loading any further report and closing the page; cookies set by Microsoft can be deleted in your browser settings.

7. Contacting us

If you contact us via the form, by email or by phone, we process your details to handle your inquiry. The contact form transmits your email address, the selected area, your role, your message and, if added, the values from the effort estimate through a server function at Cloudflare (see hosting) and Microsoft’s email service Azure Communication Services as an email to our Microsoft 365 mailbox. The server function stores nothing; the inquiry exists only as an email in our mailbox and is deleted once it has been dealt with and no retention obligations apply. The legal basis is Art. 6(1)(b) GDPR where your inquiry aims at a contract, otherwise our legitimate interest in responding (Art. 6(1)(f) GDPR).

Spam protection: as soon as you start filling in the form, we load Cloudflare Turnstile (Cloudflare, Inc., see hosting). Turnstile checks, based on technical characteristics of your browser and your IP address, whether a person is sending the form, and sets no cookies for advertising or analytics. Without this check we could not protect the form against automated bulk requests. The legal basis is our legitimate interest in a secure contact channel (Art. 6(1)(f) GDPR); access to your device is strictly necessary for this service you request (Section 25(2) no. 2 TDDDG). Turnstile is not loaded when you merely open the page. Alternatively you can always reach us by email or phone.

Booking: on the construction procurement analytics page you can choose a slot for the first check directly through Microsoft Bookings. The calendar loads only when you request it with a click; before that, no connection to Microsoft is made. After the click, Microsoft (Microsoft Ireland Operations Limited, Ireland) processes your IP address and browser data and, if you book, the details you enter there such as name, email address and chosen time. So that the calendar can be displayed and work, Microsoft creates cookies and entries in your browser storage (local storage, session storage) within the embedded calendar, among others for its sign-in library, the Microsoft Authentication Library (MSAL). Microsoft sets these entries, not we; you can delete them in your browser settings. We use these details to hold the appointment. The legal basis is your request (Art. 6(1)(b) GDPR); access to your device happens at your express request (Section 25(2) no. 2 TDDDG). For Microsoft 365, the data processing agreement and the information in the following paragraph apply. Alternatively you can reach us via the contact form, by email or phone.

For email we use Microsoft 365 (Exchange Online), and for sending the contact form Azure Communication Services (data location Europe), both from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, on the basis of a data processing agreement (Art. 28 GDPR). Within the EU Data Boundary, the data is generally processed in the EU; for any transfers to Microsoft Corporation (USA) we rely on its certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and additionally on EU standard contractual clauses. We delete the data once it is no longer needed to handle your inquiry and no statutory retention obligations apply.

8. Applications through JOIN

Open positions are published on the JOIN platform (join.com); we receive applications through JOIN’s application form, where JOIN’s privacy notice applies in addition. We process your application data solely to carry out the application process (Art. 6(1)(b) GDPR, for special categories of personal data Art. 9(2)(b) GDPR). If no employment results, we delete the data no later than six months after the process ends, unless you have consented to longer storage. JOIN (JOIN Solutions AG, Eichenstrasse 2, 8808 Pfäffikon SZ, Switzerland; EU representative: JOIN Solutions GmbH, Schönhauser Allee 36, 10435 Berlin, Germany) processes the application data on our behalf (Art. 28 GDPR). For Switzerland there is an adequacy decision of the European Commission (Art. 45 GDPR).

9. Company page on LinkedIn

We operate a company page on LinkedIn. For the page statistics (Page Insights) we are joint controllers with LinkedIn Ireland Unlimited Company (Art. 26 GDPR); LinkedIn provides the essence of the arrangement. The legal basis is our legitimate interest in communicating with interested parties (Art. 6(1)(f) GDPR). The website only links to LinkedIn; data flows only once you follow the link. We have no influence on the data LinkedIn stores about your use or on how long it is stored. You can also exercise your rights directly with LinkedIn.

10. Obligation to provide data and automated decisions

You are under no statutory or contractual obligation to provide us with personal data. Without your details, however, we cannot handle an inquiry or application. There is no automated decision-making, including profiling (Art. 22 GDPR).

11. Your rights

Subject to the legal requirements, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). You can withdraw any consent at any time with effect for the future.

Your right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. An informal email to [email protected] is sufficient.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.

As of October 2026. Legally pre-checked on 20 October 2026, not legal advice. Final legal sign-off is still pending.