Privacy notice for Pentao

In short: the calculator on this page runs only in your browser; your birth details never leave your device. For the waitlist we store your email address, and you are only on the list once you confirm, for at most twelve months. No advertising, no sharing for advertising.

1. Controller

NorthProfit UG (haftungsbeschränkt)
Waldnieler Straße 28
40549 Düsseldorf
Germany

Email: kontakt@northprofitstudio.de

2. The calculator

Your browser processes the date, time and place of birth. We don’t receive them, nor does anyone else, and the page doesn’t store them; when you reload the page, they are gone.

3. Waitlist

When you sign up, we store:

• your email address
• the language of the page (German or English)
• the interests you choose voluntarily
• the version of this notice that applied when you signed up
• campaign parameters from the page address (utm_source, utm_medium, utm_campaign), if present
• the times of signup, last confirmation email and confirmation, and the number of confirmation emails

The purpose is to send you the confirmation email and an email when Pentao launches. Your interests help us plan the app; the campaign parameters show us which mentions bring people to Pentao. The legal basis is your consent (Art. 6(1)(a) GDPR). We store the time and version to be able to prove your consent (Art. 7(1) GDPR).

Confirmation (double opt-in). After you sign up, we send you an email with a link that is valid for 7 days. You are only on the list once you confirm on our page. If you don’t confirm, we delete the entry 7 days after the last confirmation email. We send at most three confirmation emails per address in 24 hours.

Unsubscribing. Every email contains an unsubscribe link, and many email apps show a button for it. When you unsubscribe, we delete your entry immediately. You can also withdraw your consent by email to kontakt@northprofitstudio.de.

Where it is stored. The waitlist is kept in our access-protected NorthProfit Cockpit on our own server at STRATO GmbH in Germany. As daily figures without addresses, we keep how many people signed up, confirmed or unsubscribed per day and campaign, and how many confirmation emails could not be sent.

Protection against abuse. To stop anyone from entering other people’s addresses in bulk, we limit the number of attempts per IP address and per email address. For this we keep the IP address only briefly in memory and do not store it (Art. 6(1)(f) GDPR; our legitimate interest is operating the waitlist securely).

4. Sending emails

• We send the waitlist emails via Amazon Simple Email Service (SES) of Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, from a data centre in Frankfurt am Main. Amazon acts as our processor.
• Amazon receives your email address and the content of the email.
• Where data reaches Amazon Web Services, Inc. in the USA, this is based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, under which Amazon Web Services is certified. In addition, the EU standard contractual clauses in the AWS data processing agreement apply (Art. 45 and 46 GDPR).
• The legal basis is your consent (Art. 6(1)(a) GDPR).

Proof of delivery. Amazon SES reports to our NorthProfit Cockpit via the notification service Amazon SNS (also Amazon Web Services EMEA SARL, AWS region Frankfurt) whether an email was sent, delivered or delayed, whether it bounced or whether someone complained about it. For this we store the recipient address, sender, subject, delivery status, time and the technical ID of the email, but not its content, and delete the entries after 30 days. The purpose is to prove delivery and to be able to help you with questions. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is demonstrably reliable delivery.

5. This website

Server. When you visit, the server processes technically necessary connection data for secure delivery and to limit abuse. We don’t set marketing cookies. Fonts and scripts load only from our own server.

Measuring the reach of this website. We measure how this website is used ourselves, without Google Analytics or other third parties. Without your consent we measure without measurement cookies and without storing anything on your device for measurement: pages viewed, the name of the referring website, campaign parameters from the address and clicks on our download buttons and on links to the App Store, Google Play and other websites, each without content. From the information your browser sends anyway, we derive device type, browser, operating system and language in broad categories, and from the IP address on receipt the country, region and city. From the IP address and browser identifier we form, with a key that is newly generated each day and held only in memory, an identifier that stays the same only for that day; only its hash value is stored, never the IP address. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is improving the pages based on aggregated usage figures.

With your consent we also set our own cookies: “__Host-np_vid” with a random visitor ID for 12 months and “__Host-np_sid” for the session for 30 minutes. This lets us recognise returning visits. We then also record scroll depth, active time, page load times and a broad screen size class. The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

We store your choice in “Privacy settings”, including a refusal, for 12 months in the cookie “__Host-np_consent”; this is necessary so that we respect it (Section 25(2) No. 2 TDDDG). As long as you don’t make a choice, we store nothing. Via “Privacy settings” at the end of every page you can withdraw your consent at any time or switch measurement off completely; we then delete the measurement cookies and the measurement data stored with your visitor ID. If your browser sends the “Global Privacy Control” signal, we don’t measure at all. We store the measurement data in our access-protected NorthProfit Cockpit on servers of STRATO GmbH in Germany and delete it after 180 days. We determine the location on our own server with the database IP Geolocation by DB-IP (licence CC BY 4.0).

6. Storage periods

• Calculator: nothing is stored.
• Unconfirmed signup: 7 days after the last confirmation email.
• Confirmed signup: until you unsubscribe, at most 12 months after signing up.
• Proof of delivery: 30 days.
• Measurement data: 180 days.

7. Your rights

Subject to the legal requirements, you have the right to access, rectification, erasure, restriction, data portability and objection. You can withdraw consent at any time with effect for the future. Contact: kontakt@northprofitstudio.de. Competent supervisory authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

8. Changes

We update this notice when features, service providers or legal requirements change. The current version is always available at this address.