Privacy Policy

Last updated: November 2026

This policy tells you, as required by Art. 13 GDPR, which personal data is processed when you visit this website, send an enquiry or book an appointment.

1. Controller

Crisptwist Consulting GmbH
Baggesenstieg 18, 22393 Hamburg, Germany
Represented by the Managing Director: Selin Billi Mallinson
Phone: +49 162 210 75 89
Email: hello@crisptwist.com

2. Hosting and technical service providers

This website is built and run on the DevAny platform (DevAny LLC, Wyoming, USA). DevAny processes the website's data on our behalf and uses these subprocessors to do so:

For more information, see DevAny's privacy policy.

3. Visiting the website

When you open a page, your browser sends technically necessary data to Cloudflare, in particular your IP address, the address requested, the time and browser details. This data is needed to deliver the page and keep the service secure, and it may appear in technical logs for a limited period. Your IP address is not written to the website's database.

The platform counts page views only as a total per day and page. No IP address, identifier, cookie or referring page is stored, and the counters contain nothing about individual visitors. If a script error occurs in your browser, a short technical error message and the page path are stored.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website securely and reliably and in knowing how it is used in aggregate.

4. Cookies and local storage

This website sets no cookies for visitors and stores nothing in your browser's local storage or session storage. The language follows solely from the address you open. No analytics, advertising or social media services are integrated. On loading, a platform script only checks whether local storage is available, without storing anything there.

5. Fonts and images

This website's fonts and images are embedded directly in the document. Loading its pages does not fetch anything from third parties, including Google Fonts.

6. Contact form

Through the contact form we collect your name and email address (required) and your company and message (optional). We also store your confirmation of the privacy notice, the language and the page the enquiry came from. A hidden field serves to fend off automated submissions; if it is filled in, nothing is stored.

We use this data to reply to your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to a contract or pre-contractual steps, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in handling enquiries).

The enquiry is stored in our DevAny dashboard. We are notified of it by email; this message contains your details and is sent via Resend.

7. Booking an appointment

You can arrange appointments on the booking page at /book, a DevAny module. We process your name and email address (required), your phone number and a note (optional), the service and time you choose, the language, the page you came to the booking from and your confirmation by checkbox.

We review your booking and confirm the appointment. You receive emails about this via Resend: acknowledgement, confirmation or decline, notices of rescheduling and cancellation, and a reminder about 24 hours beforehand. The emails contain a calendar file (.ics) or a link to one and a personal management link. This link can be used to view, move or cancel the appointment, so please do not pass it on. Only a hash of the token it contains is stored. We also receive email notifications about your booking.

To prevent abuse, the form contains a hidden field. In addition, your IP address is used briefly in the platform's working memory to limit the number of requests (a window of up to 10 minutes); it is not written to the database.

The legal basis is Art. 6(1)(b) GDPR for arranging and holding the appointment and Art. 6(1)(f) GDPR for abuse prevention.

If the appointment takes place as a video call, we send you a Google Meet link. The booking system does not transfer any data to Google for this. Once you join the call, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is the provider of Google Meet, and Google's privacy policy applies.

8. Retention

There is no automatic deletion period for enquiries and appointments. We delete this data once it is no longer needed for its purpose, at the latest when statutory retention periods have expired. The platform keeps only the most recent technical error messages (200 at most); older ones are deleted automatically. The daily page view counters contain no personal data.

9. Transfers to the USA

DevAny and the service providers named in section 2 are based in the USA, so personal data may be transferred there. The basis for this is the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the provider in question participates, the EU-US Data Privacy Framework (Art. 45 GDPR). The database itself is located in the EU (Frankfurt).

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw any consent you have given at any time with effect for the future (Art. 7(3)). To exercise these rights, contact hello@crisptwist.com.

Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.

You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (the Hamburg Commissioner for Data Protection and Freedom of Information).

11. Obligation to provide data and automated decisions

You are under no statutory or contractual obligation to provide data to us. Without the required details, however, we cannot process your enquiry or arrange an appointment. No automated decision-making, including profiling (Art. 22 GDPR), takes place.