PrivacyPolicy.

The controller responsible for the processing of personal data within the meaning of the GDPR and other data-protection law is:

A statutory data protection officer is not required by law in our case. For data protection enquiries, please contact us directly at the address above.

The following overview summarises the categories of data we process and the purposes of processing.

Categories of data processed

• Master data (e.g. names, company name)
• Contact data (e.g. email, phone)
• Content data (e.g. form submissions, messages)
• Usage data (e.g. pages visited, time spent)
• Meta / communication data (e.g. IP address, device information)

Categories of data subjects

• Visitors and users of the website
• Prospects, clients and business partners

Purposes of processing

• Operating the website, its features and content
• Responding to enquiries and communicating with users
• Audience measurement and improvement of the offer
• IT security and protection against misuse

We process personal data exclusively on one of the following legal bases:

• Consent (Art. 6 (1) (a) GDPR): You have given us your explicit consent to the processing.
• Contract (Art. 6 (1) (b) GDPR): The processing is necessary to perform a contract or to take pre-contractual steps.
• Legal obligation (Art. 6 (1) (c) GDPR): The processing is necessary to comply with a legal obligation (e.g. commercial and tax record-keeping requirements).
• Legitimate interests (Art. 6 (1) (f) GDPR): The processing is necessary for the purposes of legitimate interests, where your interests or fundamental rights do not override.

In line with Art. 32 GDPR and the state of the art, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk. These include:

• Encrypted data transmission via TLS (HTTPS)
• Access controls and permission management
• Selection of processors with demonstrable data protection standards (Art. 28 GDPR contracts)
• Regular updates of the software stack
• Data minimisation and timely deletion routines

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel processes the data necessary to deliver the content via its global edge infrastructure, with the EU region (Frankfurt, fra1) prioritised. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in performant and secure delivery).

As Vercel is headquartered in the United States, transfers there are covered by the EU-US Data Privacy Framework (Vercel is certified) and additionally by EU Standard Contractual Clauses (SCC) under Art. 46 GDPR.

When you visit our website, server logs automatically capture the following data your browser transmits:

• IP address of the requesting machine (truncated where technically possible)
• Date and time of the request
• Name and URL of the file requested
• Referring website (referrer URL)
• Browser used and operating system

This data is processed for IT security and reliable delivery of the website and is deleted or anonymised after 30 days at the latest. It is not merged with other data sources.

Vercel's privacy policy: vercel.com/legal/privacy-policy

When you contact us via a form or by email, we process the data submitted for the purpose of handling your enquiry and any follow-up.

Data processed: name, email, optionally company and team size, content of your message.
Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures) and Art. 6 (1) (f) GDPR (legitimate interest in efficient handling of enquiries).
Retention: until your enquiry has been fully handled. Resulting contractual correspondence is kept for up to ten years in line with German commercial and tax law.

Processor: Resend

For the delivery of form submissions and notifications we use Resend (Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). A data processing agreement under Art. 28 GDPR is in place with Resend. The transfer to the United States is covered by the EU-US Data Privacy Framework and EU Standard Contractual Clauses.

Resend's privacy policy: resend.com/legal/privacy-policy

This website uses strictly necessary storage only. We do not deploy tracking cookies, marketing cookies or third-party trackers.

Storage in use

• NEXT_LOCALE (cookie): remembers your selected language preference (German/English). Lifetime: up to 12 months. Legal basis: Art. 6 (1) (f) GDPR.
• vs-intro-seen (sessionStorage): remembers whether the loading screen has already been shown in your current browser session. Cleared when you close the tab.

Because only strictly necessary storage is used, no consent is required under § 25 (2) (2) TDDDG.

We engage carefully selected service providers that support the operation of the website. Where legally required, data processing agreements under Art. 28 GDPR are in place with all listed providers.

• Vercel Inc. (USA), hosting and delivery of the website, edge infrastructure primarily in the EU region Frankfurt.
• Resend Inc. (USA), delivery of transactional emails triggered by forms.

A complete list of sub-processors is available on request.

You have the following rights regarding your data:

• Access (Art. 15 GDPR): you may request information about whether and which personal data we process about you.
• Rectification (Art. 16 GDPR): you may request correction of inaccurate data.
• Erasure (Art. 17 GDPR): you may request deletion of your data under certain conditions.
• Restriction (Art. 18 GDPR): you may request that processing be restricted.
• Data portability (Art. 20 GDPR): you may receive your data in a structured, common and machine-readable format.
• Objection (Art. 21 GDPR): you may object to processing based on legitimate interests.
• Withdrawal of consent (Art. 7 (3) GDPR): you may withdraw consent given at any time, with effect for the future.

To exercise your rights, an informal message to info@visiblescale.com is sufficient.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, your place of work or the place of the alleged infringement.

The authority responsible for us is:

This privacy policy is current as of Mai 2026.

Due to changes to our website or new legal or regulatory requirements, this policy may need to be updated. The current version can always be accessed on this page.