enaudo
Book

Privacy policy

Preamble

This privacy policy explains which types of personal data (hereinafter also “data”) we process, for which purposes and to what extent. It applies to all processing of personal data we carry out, both in providing our services and in particular on our websites, in mobile applications and in external online presences such as social-media profiles (hereinafter collectively the “online offering”). The terms used are gender-neutral.

Last updated: 4 November 2026

Controller

Leonardo Scharl
Britzer Damm 107
12347 Berlin
Email: info@enaudo.de
Legal notice: enaudo.de/en/impressum

Overview of processing

The following overview summarises the types of data processed, the purposes of processing, and the categories of data subjects.

Types of data processed

  • Master data (e.g. names, addresses).
  • Contact data (e.g. email, telephone numbers).
  • Content data (e.g. entries in online forms).
  • Usage data (e.g. pages visited, interest in content, access times).
  • Meta, communication and procedural data (e.g. IP addresses, timestamps).

Categories of data subjects

  • Communication partners.
  • Users (e.g. website visitors).

Purposes of processing

  • Security measures.
  • Providing our online offering and usability.
  • IT infrastructure.
  • Contact enquiries and communication.
  • Appointment management.

Relevant legal bases

Relevant legal bases under the GDPR: below is an overview of the GDPR legal bases on which we process personal data. Please note that, in addition to the GDPR, national data-protection rules may apply in your or our country of residence or establishment.

  • Consent (Art. 6(1) sentence 1 lit. a GDPR) — the data subject has given consent to the processing of their personal data for one or more specific purposes.
  • Performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 lit. b GDPR) — processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legal obligation (Art. 6(1) sentence 1 lit. c GDPR) — processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR) — processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

National data-protection rules in Germany: in addition to the GDPR, national data-protection rules apply in Germany, in particular the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG).

Security measures

In accordance with legal requirements, taking into account the state of the art, implementation costs and the nature, scope, circumstances and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to it. Securing online connections with TLS/SSL encryption (HTTPS) is mandatory.

Transfer of personal data

In the course of processing personal data, data may be transferred to or disclosed to other bodies, companies, legally independent organisational units or persons. In such cases we comply with legal requirements and in particular conclude corresponding contracts or agreements.

International data transfers

Data reaches the USA when you open the Cal.com booking window yourself. The basis is the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45(3) GDPR). Our email provider Infomaniak is based in Switzerland; the European Commission’s adequacy decision for Switzerland applies. Through the former form on our NFC page, names were also sent to Groq (USA) and contacts were stored in Google Contacts, see the section on the contact form.

General information on storage and deletion

We delete personal data that we process in accordance with legal requirements as soon as the underlying consents are withdrawn or there are no further legal bases for processing. Where retention obligations apply, we follow German commercial and tax retention periods (6 to 10 years).

Rights of data subjects

As a data subject you have the following rights under the GDPR:

  • Access (Art. 15 GDPR), rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR).
  • Restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR).
  • Objection to processing (Art. 21 GDPR).
  • Withdrawal of consent with effect for the future (Art. 7(3) GDPR).
  • Complaint to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for enaudo is the Berlin Commissioner for Data Protection and Freedom of Information.

Right to object: where we process data on the basis of legitimate interests (Art. 6(1) sentence 1 lit. f GDPR), you may object at any time on grounds relating to your particular situation. An informal message to info@enaudo.de is sufficient.

Provision of the online offering and web hosting

We process users’ data in order to provide our online services. Our website runs on IONOS servers in Germany and is delivered via the Bunny.net (BunnyWay d.o.o.) content delivery network.

  • Types of data processed: usage data; meta, communication and procedural data.
  • Data subjects: users.
  • Purposes of processing: providing our online offering and usability.
  • Legal bases: legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Further notes on processing operations, procedures and services:

  • Bunny.net: hosting, DNS infrastructure and content delivery network (CDN). The provider acts as a host and filter between users and our server to secure the website and optimise load times. Processing by Bunny.net is covered by a data processing addendum; Provider: BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia; Website: https://bunny.net/; Privacy policy: https://bunny.net/privacy/; Basis for third-country transfers: as the provider is established in the EU, there is in principle no third-country transfer.

Email communication

If you contact us by email, the personal data you send is stored automatically. Data transmitted to us on a voluntary basis is stored for the purpose of processing the enquiry or contacting the data subject.

  • Types of data processed: master data (e.g. names, addresses); contact data (e.g. email, telephone numbers); content data (e.g. text in emails, documents); meta, communication and procedural data.
  • Data subjects: communication partners, prospects, customers.
  • Purposes of processing: contact enquiries and communication.
  • Legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 lit. b GDPR), legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Email infrastructure provider:

Contact enquiries and webhooks (IONOS, Hetzner)

When users complete the contact form on our website, we process the data entered to handle the enquiry. Data sent via the contact form is transmitted securely via a webhook to our automation software and stored in a database. Backups are created regularly to protect the data. Our NFC page used to offer the “Kontakt austauschen” form. We no longer collect data through it. When the form was used, we sent your name to Groq (USA) for processing and stored the contact in Google Contacts. We store the details submitted at that time in order to follow up with you (Art. 6(1) sentence 1 lit. f GDPR; our legitimate interest is responding to your contact request). We do not send promotional emails on this basis.

Specific privacy note: automation and database for contact enquiries run on servers of the providers named below in the EU. The webhook call passes through the Bunny content delivery network.

Spam protection: to protect our forms against automated spam and denial-of-service attacks we use a self-hosted proof-of-work mechanism (ALTCHA) directly on our server infrastructure. In the background your browser solves a short mathematical challenge to verify human input. No cookies are set, no tracking or profiling mechanisms are used, and no data is transferred to external third parties (legal basis: Art. 6(1) sentence 1 lit. f GDPR to ensure IT security and defend against abusive requests).

  • Types of data processed: master data (e.g. name, company); contact data (e.g. email address, telephone number); content data (e.g. message, budget, how you heard about us); meta, communication and procedural data.
  • Data subjects: users (prospects, communication partners).
  • Purposes of processing: contact enquiries and communication; initiation of a contract; data backup; evaluating our contact channels.
  • Legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 lit. b GDPR), legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).
  • Storage period: we delete enquiries that do not lead to an assignment no later than 6 months after the last contact. If an assignment follows, we keep records subject to retention for the statutory periods (in particular Section 147 AO and, where applicable, Section 257 HGB; 6 to 10 years depending on the type of record). Deleted data remains in backups for around two months for technical reasons.

Providers of server infrastructure and databases:

Appointment booking (Cal.com)

To arrange appointments (e.g. introductory calls) we use the online booking tool “Cal.com”.

Specific privacy note: to protect your data, the Cal.com booking widget does not connect to Cal.com’s servers when our website is merely loaded. Only when you click or tap a “Book an intro call” button and confirm in the notice window that then appears by choosing “Agree and open calendar” is the external script loaded and the booking window opened. We point this out in the notice window and on the homepage directly below the button. Within the same page view, a further click opens the calendar without asking again; we do not store your confirmation. Your IP address is then transmitted to Cal.com so the widget can be displayed on your screen. Cal.com may set cookies in the process, such as the “__cf_bm” security cookie from Cloudflare, which helps detect automated access and expires after around 30 minutes of inactivity. From within the booking window, your browser also sends technical diagnostic data to Sentry (USA), the error and performance monitoring service used by Cal.com; your IP address reaches this recipient as well. Cal.com names its other service providers in its list of subprocessors.

If you book an appointment, the data you enter is processed for appointment management.

  • Types of data processed: master data (e.g. name); contact data (e.g. email address); content data (e.g. appointment details); meta and procedural data (e.g. IP addresses when the widget is loaded, technical diagnostic data).
  • Data subjects: users (prospects, communication partners).
  • Purposes of processing: arranging appointments, internal organisation, pre-contractual communication, technical delivery and error diagnostics of the booking window.
  • Legal bases: consent (Section 25(1) TDDDG, Art. 6(1) sentence 1 lit. a GDPR) for loading the booking window, the transmissions this triggers and related cookies through your confirmation in the notice window; pre-contractual steps (Art. 6(1) sentence 1 lit. b GDPR) for your booking data. To withdraw with effect for the future, close the window and reload the page, so that Cal.com does not load again; an email to info@enaudo.de is also sufficient. A cookie that has already been set then expires or can be deleted in your browser.

Further notes on processing:

  • Cal.com: software for online appointment booking; Provider: Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA; Website: https://cal.com/; Privacy policy: https://cal.com/privacy; Basis for third-country transfers: the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45(3) GDPR). Cal.com, Inc. and Sentry (Functional Software, Inc.) are listed there as active participants (checked on 4 November 2026).

Use of cookies

Our website itself sets no cookies when you visit it. Cookies can only be set by the Cal.com calendar once you have confirmed it (see “Appointment booking”).

When you switch language, we briefly keep your scroll position in your browser’s session storage so you can continue reading at the same place. The value is used after the switch and deleted at the latest when you close the tab. This is necessary for the function you have chosen (Section 25(2) no. 2 TDDDG).

Changes and updates

Please review the content of this privacy policy regularly. We adapt it as soon as changes to the processing we carry out make this necessary.

Book an intro call

The calendar is loaded from Cal.com (USA). To book the appointment and diagnose errors, technical data such as your IP address and diagnostic data go to Cal.com and its service providers in the USA; cookies are possible. No connection to Cal.com is made before you confirm. You can withdraw your consent at any time: close the window and reload the page. Details in the privacy policy

Use the enquiry form instead info@enaudo.de