Privacy Policy

Last updated: 8 May 2026

This is a translation of our German privacy policy. In case of doubt, the German version prevails.

1. Controller

The controller within the meaning of Art. 4 No. 7 GDPR is:
Plateau Candy GmbH & Co. KG
Lichtstraße 26–28
50825 Cologne
Germany
Represented by: Kolja Pitz (Managing Director of the general partner Plateau Candy Verwaltungs GmbH)
Email: hi@plateaucandy.de
Phone: +49 221 57770 500

We are not legally required to appoint a Data Protection Officer and have not appointed one (§ 38 BDSG).

2. General notes on data processing

We process personal data only on the basis of statutory provisions, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications and Digital Services Data Protection Act (TDDDG). This statement explains the type, scope and purpose of processing as well as the legal basis for each processing activity.

3. Accessing the website (server log files)

When you visit this website, our hosting provider Vercel automatically collects technical access data transmitted by your browser: IP address, date and time of access, requested URL, referrer URL, browser and version, operating system, language. This data is technically necessary to deliver the website, to ensure its stability and security, and to defend against attacks.

• Purpose: service delivery, IT security, error analysis
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation)
• Retention: typically up to 30 days; in security incidents until final resolution
• Recipients: Vercel Inc. as processor (see Section 6)

4. Contact via email or phone

If you contact us by email or phone, we process the data you provide (name, contact details, request, message content) in order to handle your enquiry.

• Purpose: handling enquiries, initiating and performing a possible contractual relationship
• Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) or Art. 6(1)(f) GDPR (handling of general enquiries)
• Retention: until the enquiry has been finally handled; statutory retention periods (e. g. commercial or tax law) remain unaffected

5. Booking via Cal.com

Our website contains references to an external booking service at cal.eu/plateaucandy. We do not embed this tool. When you click the link, you leave our website. The provider is Cal.com, Inc., with EU subsidiary Cal.com Europe SL. Cal.com's privacy policy applies on their platform. Data transmitted is what is required to schedule a meeting (name, email, selected time slot, optional notes).

• Purpose: scheduling introductory or consulting meetings
• Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps)
• Provider's privacy policy: cal.com/privacy

6. Processors and third-party providers

6.1 Vercel (hosting)

This website is hosted on the platform of Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel processes personal data on our behalf (server logs, served content) under our instructions. We have concluded a Data Processing Agreement under Art. 28 GDPR with Vercel. Transfers to the USA are based on the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). Vercel DPA.

6.2 Sanity (content management)

For managing and delivering content we use the headless CMS Sanity provided by Sanity AS (Schweigaards gate 21–23, 0191 Oslo, Norway). Primary storage of the so-called Content Lake is in the europe-west1 region (St. Ghislain, Belgium) on Google Cloud infrastructure. A US affiliate (Sanity US Inc.) may be involved in a supporting role. We have concluded a Data Processing Agreement under Art. 28 GDPR with Sanity. Any transfers to recipients outside the EU/EEA are safeguarded by Standard Contractual Clauses. Sanity Privacy Policy.

6.3 Mux (video delivery)

For delivering moving image on project detail pages we use Mux (Mux Inc., 1455 Market Street, San Francisco, CA 94103, USA). Mux processes the technical data necessary for adaptive video delivery (IP address, device and browser information, streaming tokens). We have concluded a Data Processing Agreement under Art. 28 GDPR with Mux. Transfers to the USA are based on the EU Commission's Standard Contractual Clauses. Mux pseudonymises IP addresses where the Mux Data SDK is deployed in the EU region. Mux DPA.

7. Cookies and similar technologies

This website does not generally set cookies or tracking. We do not use analytics, advertising or social-media pixels. Only strictly necessary access to storage on your device is used, as far as required for the operation of the website or for a function explicitly requested by you (§ 25(2)(2) TDDDG). This includes in particular:

• Storing your selected language (localStorage), to preserve your choice across visits
• Session-related tokens of the video player (Mux), required for playback of selected videos

No consent is required for these accesses, as they are strictly necessary within the meaning of § 25(2)(2) TDDDG.

8. International data transfers

Within the processor relationships described above, personal data may be transferred to recipients in the USA (Vercel, Mux, possibly Sanity affiliates). We have concluded the EU Commission's Standard Contractual Clauses with all relevant processors (Art. 46(2)(c) GDPR) and review whether additional safeguards are required.

9. Your rights

Regarding the personal data we process about you, you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an informal message to hi@plateaucandy.de is sufficient.

10. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44, 40102 Düsseldorf, Germany
www.ldi.nrw.de

11. Changes to this statement

We update this privacy policy when our processing activities, the services used, or the legal landscape change. The current version is always available on this page; the date at the top indicates the most recent revision.