Privacy policy

What this website doesn’t do

We do not measure who you are. We count page views, without cookies and without recognising you (see “Statistics”). There are no tracking pixels, no advertising networks and no profile built across your visits.

As long as you are only reading, we set no cookie. A cookie appears only when you sign in: it keeps you signed in and is technically necessary for that. What exactly sits in your browser is listed under “What is stored in your browser”.

Who is responsible

The controller under the GDPR is the company also named in the imprint. The details below this section are the same as there: company name, address, who represents it, register and how to reach us.

For questions about data protection and to exercise your rights, write to the e-mail address below or use the contact form. No data protection officer is appointed, because the conditions requiring one are not met.

Represented by the managing director Steven Strehl

Register court: Amtsgericht Charlottenburg (Berlin)

Register number: to follow

Registered office: Berlin

E-mail: hi@everykein-spampreneurs.com.invalid

Contact form: https://everypreneurs.com/en/contact

Delivering the website

This website sits as finished files at bunny.net, operated by BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia. The files are stored in Falkenstein, Germany, and delivered only from locations inside the EU.

To get a page to you, bunny.net processes technically necessary connection data. That includes your IP address, the address requested, the time and your browser identification.

The legal basis is our legitimate interest in delivering the site reliably and securely, Art. 6(1)(f) GDPR. No website can be delivered without this processing.

Newsletter

For the newsletter we pass your e-mail address to Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. Brevo belongs to Brevo SAS in Paris and sends the newsletter on our behalf.

We use double opt-in: after you submit, you receive an e-mail with a link, and only your click on that link puts you on the list. Until then your address is not subscribed.

Submitting the form discloses your IP address to Brevo, because the form posts directly to them. The notice under the field says so before you type anything.

The legal basis is your consent, Art. 6(1)(a) GDPR. We keep the address until you unsubscribe, and the link for that is in every newsletter.

When you’re signed in, our service checks with Brevo whether your account’s address receives the newsletter. If it doesn’t, your account shows a task to subscribe; if you have unsubscribed, it shows nothing. The service keeps the answer in memory for up to a day, not in the database. If you subscribe there with one click, our service sends your address to Brevo’s form, and the same double opt-in as above applies; we record when you last asked for it. The legal basis for the check is our legitimate interest in showing you in your account what is still open, Art. 6(1)(f) GDPR.

Donations

The donation form comes from bcause GmbH, Meinekestraße 26, 10719 Berlin, Germany. It is loaded only when you ask for it. You do that by clicking “Support us now” or “Open donation form”; next to each it says that bcause sees your IP address.

Before that nothing is fetched from bcause, and bcause learns nothing about your visit. After the click, whatever you enter into the form falls under bcause’s own privacy policy.

The legal basis for loading it is your consent, Art. 6(1)(a) GDPR. bcause also issues the donation receipt and is the controller for the payment data.

Forms

Five forms on this website go to Formward (Sweden, EU): the questionnaire, the feedback after unsubscribing from the newsletter, the follow-up question on the thank-you page, the contact form, and the call-back request next to “Book a time”. Formward is operated by EGF Fastighetsservice AB, registration number 559501-3573, 106 31 Stockholm, Sweden.

Formward (Sweden, EU) processes the entries on our behalf. The data sits in Sweden, and notifications are sent through providers inside the EU. Your IP address is not stored there in the clear, only as a checksum. For the contact form and the call-back request, Formward sends your entries as an e-mail to our mailbox on everypreneurs.com, hosted at mailbox.org (more on this under “Contact”).

What is transmitted depends on the form. The questionnaire, the unsubscribe feedback and the follow-up on the thank-you page ask for neither your name nor your address. In the contact form you give your name, your e-mail address and your message; we need the address in order to reply.

The legal basis for the contact form is our legitimate interest in answering enquiries, Art. 6(1)(f) GDPR. Where an enquiry concerns a contract or the steps leading to one, it is Art. 6(1)(b) GDPR. You can object to the processing at any time by writing to us at the address under “Contact”.

We keep your enquiry for as long as we are dealing with it, and after that for as long as the law requires. Once both are over, we delete it. The answers from the three anonymous forms are evaluated in aggregate; they hang on no account and no name.

With “Request a call back” you give your name, phone number and a topic, and if you like, when you can be reached. The language of the page goes with them, so that we know which language to call you in. We use these details only to call you back.

The legal basis is the same as for the contact form: our legitimate interest in answering your request, Art. 6(1)(f) GDPR, and Art. 6(1)(b) GDPR where it concerns a contract or the steps leading to one. You can object to the processing at any time by writing to us. We keep it the same way, too: we hold on to your request for as long as we are dealing with it, and after that for as long as the law requires. Once both are over, we delete it.

To detect spam, Formward has every submission assessed by language models from Mistral AI, 15 rue des Halles, 75001 Paris, France. For the contact form that means your name and your message pass through this check as well, and for the call-back request your name, your phone number and your topic. The assessment only sorts; it decides nothing about you, and no automated decision within the meaning of Art. 22 GDPR takes place.

Your account

You don’t need a password for an account. Signing in runs through Hanko: you enter your e-mail address and confirm with a code from the mail or with a passkey. Hanko is Hanko GmbH, Am Sandtorkai 27, 20457 Hamburg, Germany; they run the sign-in on our behalf and store your address and your sign-in methods for it.

The mail with the code is sent either by Hanko itself or by our own service, which runs at Scalingo SAS in Paris, through Brevo GmbH (address under “Newsletter”). Which of the two applies is a setting at Hanko. When the mail goes through our service, Hanko gives it your e-mail address, the code and the language of the page, and the service passes them on to Brevo; we don’t store the code. The same goes for the code that confirms a new address. The legal basis is Art. 6(1)(b) GDPR, because without the code there is no sign-in.

On our side, a row appears with an identifier that Hanko issues. That is what links the two, not your address: you stay the same person if you change your address.

We also store what you enter in your account: first name, last name and how far along you are with your business. Those three are required, because the business portrait doesn’t work without them. You can change them at any time under “Me”.

We further record when you agreed to this policy and to which version. Without that note we couldn’t say later what you agreed to. The legal basis is Art. 6(1)(b) GDPR: without an account there is no thing you came for.

Your first and last name appear in public with the business portraits you belong to.

Inside everypreneurs, only the people who operate our back office see accounts. They see who has an account and what is public; the two texts in a portrait that are shown to signed-in people only stay closed to them as well.

If someone who operates our back office changes the e-mail address of your account, we record who did it, when, and which address applied before and which after. That keeps it traceable which changes to your account came from the back office. We also send a mail through Brevo to the old address saying that the address was changed; the new one isn’t in it. If someone in the back office enters or lifts your objection to the reminders about a business portrait that has never been published, we also record who did it and when. If someone in the back office records that we’ve met you in person, changes the day or removes the record, we also record who did it, when, and which record applied before and which after. If your account is deleted, we keep these entries for another 90 days and then delete them. Your previous address stays with Hanko, our sign-in service, as an additional address for 90 days, so that you can get back into your account if it is misused; after that it is deleted. The legal basis is our legitimate interest in being able to trace changes made from the back office, Art. 6(1)(f) GDPR.

We record when you were last signed in. A published business portrait shows that day as “Last updated”.

Your account stays until you delete it or ask us to. We don’t delete it automatically, not even after a long time without signing in.

You can delete your account yourself at any time under “Account settings”. You can also write to us at the address under “Contact”.

Whether our e-mails arrive

If an e-mail that Brevo sends for us individually doesn’t arrive, such as a sign-in code, the confirmation after the contact form or the note about a join request, Brevo reports it to our service: which mail it was, when, and why, for example because the mailbox doesn’t exist or the mail was rejected. If someone marks such a mail as spam, we learn that the same way. This doesn’t apply to the newsletter.

Of that we store the kind of mail, the time, the reason, the domain of your address, meaning everything after the @, and a checksum of your address that shows us whether the same address keeps failing. We don’t store the address itself for this; if it appears in the reason Brevo gives, we make it unrecognisable first. After 90 days we delete the entry. As long as this reporting isn’t set up at Brevo, none of it reaches us.

We do this to notice when our mails don’t arrive, above all sign-in codes, without which nobody gets into their account. The legal basis is our legitimate interest in working delivery, Art. 6(1)(f) GDPR. You can object to it; the address is under “Contact”.

Your business portrait

When you are signed in, you can describe a business. We store what you enter: name, the address the portrait sits at, legal form, field, city and state, your website, a text about the business, a text about what has helped so far, a text about where it is stuck right now, and how you tag those two texts against our four core products.

Until you press “Publish”, nobody sees the entry except you and the people who belong to the same business.

Once you do, the portrait stands at everypreneurs.com/business/ and your address: name, legal form, field, city, state, website, logo, photos, the text about the business, and your name and photo. The other two texts stay visible to signed-in people only. You can unpublish at any time, and the entry is then yours alone again.

A published portrait is shown and linked on the website, for example on the home page, in the directory, on the map and next to other portraits, only once we have met in person at least one person who belongs to it (see “Consulting sessions”). Until then it can only be reached at its address and asks search engines not to include it; we don’t report it to any search engine either. Your account shows whether this applies to your portrait.

You can ask to join a published business. The person who added it then sees your name and your e-mail address, and we send them a mail through Brevo saying a request is waiting. If they accept, you belong to the business; we keep the request itself for as long as your account and the business exist.

If a published portrait doesn’t have the two texts for signed-in people, you can show the business that you’re interested in its story. For that, we store that your account registered interest in this business, and when. The people who belong to the business only see in their account how many people are interested, not who; the back office also only shows the number. We delete the entry as soon as the business has told its story, and at the latest when your account or the business is deleted. If several people have shown interest, the people who belong to the business get an e-mail about it, without a number and without names; another one only after the business has told its story and new people show interest again.

The legal basis is your consent, Art. 6(1)(a) GDPR. You decide whether to enter anything, what it says and whether it becomes public.

As long as a business portrait has never been published, we remind the people who belong to the business by e-mail, at most three times: no sooner than 3, 14 and 60 days after the last change to the portrait. Once it has been published, no more reminders come. The mail contains your first name, the name of the business, whether anything is still missing before it can be published, and a link to the portrait; it is sent through Brevo GmbH (address under “Newsletter”). For the reminders we record on the business how often and when we last sent one and when it was first published, and on your account since when we can reach you by e-mail. We delete what is recorded on the business with the business, and what is recorded on your account with your account. The legal basis is our legitimate interest in a portrait that has been set up not staying invisible without anyone noticing, Art. 6(1)(f) GDPR. You can object to the reminders at any time by writing to us through the contact page; then we stop sending them to you.

The data sits in a PostgreSQL database at Scalingo SAS, 13 rue Jacques Peirotes, 67000 Strasbourg, France. The servers are in Paris, run by 3DS Outscale. We keep your entry for as long as it exists; to delete it, write to us at the address under “Contact”.

Photos

You can upload a photo of yourself and images of your business: a logo and up to three photos. All of them are optional, and all of them are shown in public once your portrait is published.

Before we store an image, we remove what a camera writes into it: the device, the time it was taken and above all the coordinates of the place. A photo somebody takes at home would otherwise give away their home address. The colour profile stays, because it says something about colours and nothing about you.

The images sit with BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia. They are delivered through TwicPics SAS, 5 rue de Charonne, 75011 Paris, France, which resizes them on the way to the size they appear in. Both work for us and may not use the images for anything else.

The legal basis is your consent, Art. 6(1)(a) GDPR. You can remove any image at any time, and the file goes with it.

The donation figure on this page

The amount shown on the start page is read from bcause. A small program at our own address data.everypreneurs.com does that, running in the data centre and not in your browser.

So your browser asks us, and we ask bcause. Looking at a number is not a decision to donate, and bcause learns nothing about it.

Maps

The country pages carry a map from Toursprung GmbH, Mariahilfer Straße 93/20, 1060 Vienna, Austria, under the name Maptoolkit. It, too, loads only after you click.

The legal basis is your consent, Art. 6(1)(a) GDPR. Nothing is fetched from there before the click.

Statistics

We count page views with Pirsch Analytics, a service of Emvi Software GmbH, Hauptstraße 41, 92637 Weiden in der Oberpfalz, Germany.

Pirsch sets no cookie, stores nothing on your device, and issues no identifier that ties one visit to the next. Your IP address is turned into a hash that changes daily, on their server, and is not stored. The data stays in Germany.

The legal basis is our legitimate interest, Art. 6(1)(f) GDPR: we want to know which pages are read so we can make them better. Because Pirsch stores nothing on your device and does not recognise you, that outweighs the intrusion.

That also covers showing the people behind a business portrait, in their account, how often their own portrait page was opened. Those are the same numbers as above, just for that one page: nothing about individual visits and nothing that would let anyone be recognised.

Booking a time

You can book a time with us through “Book a time” at the bottom of every page; how to book the consulting sessions for your business in your account is set out under “Consulting sessions”. The calendar comes from Zeeg GmbH, Friedrichstraße 155, 10117 Berlin, Germany. Its servers are in Germany and the Netherlands, in the Open Telekom Cloud run by Telekom Deutschland GmbH.

We show you the next free slot without your browser asking Zeeg for it: our own server asks Zeeg, with no details about you, and passes on only the date and time. The page loads the Zeeg calendar only when you click “Book a time”. Only then do your IP address and the address of the page you’re on go to Zeeg.

Zeeg processes what you enter into the calendar to book, such as your name and e-mail address, on our behalf, under a data processing agreement as required by Art. 28 GDPR: to record the appointment and to send you the confirmation. Zeeg sends the confirmation e-mails through Brevo GmbH (address under “Newsletter”), which works on Zeeg’s behalf. The legal basis is our legitimate interest in being reachable for appointments, Art. 6(1)(f) GDPR.

Consulting sessions

Every business in your account comes with consulting sessions with us. For this we store in our database at Scalingo SAS (address under “Your business portrait”) which session was booked, cancelled or used for which business and which person, and when it takes place. You book at Zeeg (address under “Booking a time”): when you click “Book a time” in your account, Zeeg opens in a new tab. We put an identifier for your business, for you and for the session into the link and fill in your name and e-mail address; Zeeg keeps the identifier with the booking. Zeeg reports bookings, cancellations and changes back to us, and we check each report with Zeeg, using our own access, before we act on it. Of the booking we store only the time and a checksum of the booking number, not the number itself and no names or addresses. Steven can keep a short note on each session. We also note whether and when we’ve met you in person, from a session or by hand. Only we see the note. The record decides whether the published business portraits you belong to are shown and linked on the website and opened to search engines; the record of one person who belongs to a portrait is enough (see “Your business portrait”). Your account therefore shows whether that already applies to your portrait, but not the day or the source of the record. Anyone who already belonged to a published business before this rule existed got the record with the day it was introduced, even if we hadn’t met yet. The legal basis for this is our legitimate interest in only showing businesses on the website whose people we know, Art. 6(1)(f) GDPR. Taking part in a session decides whether you can join peer consulting and focus time. The legal basis for the sessions and the booking is Art. 6(1)(b) GDPR, because the consulting is part of what we offer you with the account; for the note and the record it’s our legitimate interest in continuing the consulting and putting the peer groups together, Art. 6(1)(f) GDPR. We delete the session details and notes with the business, and the record with your account. Sessions offered once per person, such as the get-to-know session, belong to you, not to a business: we delete their details and the notes with your account, even if you booked them through a business.

What is stored in your browser

Two values sit in your browser storage. Both are written only once you have decided something, and neither is transmitted.

When you sign in, a cookie and a third value are added. Both are set in your browser by Hanko’s sign-in software, and without them you would not stay signed in. Because they are strictly necessary for that, we do not ask for consent under § 25(2) TDDDG.

• everypreneurs.consent.v1: your answer to the privacy settings. Recording a decision does not itself require consent.
• everypreneurs.lang: the language you picked. A detected language is read on arrival and never stored.
• hanko, a cookie: the proof that you are signed in, issued by Hanko. It lasts as long as your sign-in and is deleted when you sign out. Your browser sends it only over encrypted connections and not to other websites.
• hanko_session_state: when your sign-in expires and when it was last checked, so that several open tabs agree. It sits in browser storage and never leaves your device.

Contact

If you write to us, by e-mail or through the form on the contact page, we process your message and your address to answer it. The legal basis is our legitimate interest in replying, Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR where the matter concerns a contract.

Our mailboxes are at mailbox.org, a service of Heinlein Hosting GmbH, Schwedter Straße 8/9A, 10119 Berlin, Germany. They run the mailboxes on our behalf, and the servers are in Berlin. If you send us an e-mail, it arrives there, and that is where we reply from.

The form goes to Formward (Sweden, EU). What it transmits, who operates Formward and how long we keep your enquiry is set out under “Forms”.

After you submit, we send you a short e-mail saying that your message has arrived. For that, Formward reports the submission to our own service, which runs at Scalingo SAS in Paris, and the service sends the mail through Brevo GmbH. Until that link is set up, no confirmation goes out; your message still arrives.

The service takes only your e-mail address and the language of the page from the submission. Your name and your message aren’t in the mail, and the service doesn’t store them. The legal basis for the confirmation is the same legitimate interest, Art. 6(1)(f) GDPR.

An address receives at most three confirmations a day. To count them, the service holds a checksum of your address in memory rather than the address itself, and it’s gone after a restart.

Your rights

You can ask at any time what data we process about you, and request its correction or deletion. You can also have the processing restricted, object to it, and receive your data in a portable format.

You can withdraw consent at any time with effect for the future, without affecting the lawfulness of what came before. For the newsletter, the unsubscribe link in every newsletter is enough.

You can also complain to a supervisory authority. The competent one is the Berlin Commissioner for Data Protection and Freedom of Information.

There is no automated decision-making in individual cases and no profiling.