Privacy Policy

1. Data Controller

Storm Reply GmbH
Bartholomaeusweg 26
33334 Guetersloh
Germany

Represented by: Dr. Sven Seiler
Email: unity.storm@reply.de

2. Data Protection Officer

Joerg Woste
Reply Group
Email: dpo.de@reply.de

3. Overview of Data Processing Activities

This website processes personal data through the following services:

4. Hosting

This website is hosted on Amazon Web Services (AWS), specifically using Amazon S3 and Amazon CloudFront. Servers are located in the AWS region eu-central-1 (Frankfurt am Main, Germany).

When you access this website, the following data is automatically processed by the hosting provider:

• IP address of the requesting device
• Date and time of access
• Volume of data transferred
• Referrer URL
• Browser and operating system used

This data is stored in server log files and automatically deleted after 30 days. Processing is based on Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient provision of the website).

Data Processor: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place.

5. Cookies and Consent Management

5.1 What Are Cookies?

Cookies are small text files stored on your device. Some cookies are technically necessary for the operation of the website, while others help us analyze and optimize our services.

5.2 Consent Manager

We use a cookie consent manager that allows you to grant or decline consent for various cookie categories when you first visit the website. Your decision is stored for 12 months. You can change your settings at any time via the "Cookie Settings" link in the website footer.

5.3 Cookie Categories

Strictly Necessary (always active)

• Consent cookie: Stores your cookie preferences
• Legal basis: Art. 6(1)(c) GDPR

Analytics

• Google Analytics 4 (see Section 6)
• Legal basis: Art. 6(1)(a) GDPR (consent)

Marketing

• HubSpot tracking (see Section 7)
• Legal basis: Art. 6(1)(a) GDPR (consent)

Functional

• Microsoft Bookings (see Section 8)
• Legal basis: Art. 6(1)(a) GDPR (consent)

6. Google Analytics 4

We use Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

GA4 is loaded only after your explicit consent (opt-in). No data is transmitted to Google before you grant consent.

Data processed:

• Page views and interactions
• Approximate location (based on anonymized IP)
• Device information (browser, operating system, screen resolution)
• Referring website

IP anonymization: GA4 anonymizes IP addresses by default within the EU before any transfer to the USA.

Retention period: Collected data is automatically deleted after 14 months.

Opt-out: You can withdraw your consent at any time via the cookie settings. Additionally, you can install the Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout

Data Processor: Google Ireland Limited. A data processing agreement is in place. Data transfer to the USA is based on the EU-US Data Privacy Framework.

7. HubSpot

We use HubSpot for contact forms and lead management. Provider: HubSpot Inc., 25 First Street, Cambridge, MA 02141, USA (EU subsidiary: HubSpot Ireland Limited, Dublin).

HubSpot forms and tracking scripts are loaded only after your explicit consent.

Data processed:

• Form data you submit (name, email, company, message)
• Page views and interaction data (after consent)
• IP address, browser and device information

Purpose: Processing your inquiry, lead qualification, sending requested information.

Retention period: Your data will be deleted once the purpose of processing no longer applies and no statutory retention periods prevent deletion.

Data Processor: HubSpot Ireland Limited. A DPA pursuant to Art. 28 GDPR is in place. Data transfer to the USA is based on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.

8. Microsoft Bookings

For appointment scheduling, we use Microsoft Bookings, a service provided by Microsoft Corporation (EU: Microsoft Ireland Operations Limited, South County Business Park, Leopardstown, Dublin 18).

The Microsoft Bookings calendar is embedded as an iframe and loaded only after your explicit consent.

Data processed:

• Booking data you submit (name, email, preferred time slot)
• IP address and device information

Purpose: Scheduling consultation appointments.

Data Processor: Microsoft Ireland Operations Limited. A DPA is in place. Data processing takes place within the EU (EU Data Boundary).

9. Your Rights

Under the GDPR, you have the following rights:

• Access (Art. 15 GDPR): Right to obtain information about your stored data
• Rectification (Art. 16 GDPR): Right to correct inaccurate data
• Erasure (Art. 17 GDPR): Right to deletion of your data
• Restriction (Art. 18 GDPR): Right to restrict processing
• Data portability (Art. 20 GDPR): Right to receive your data in a machine-readable format
• Objection (Art. 21 GDPR): Right to object to processing based on legitimate interests
• Withdrawal of consent (Art. 7(3) GDPR): Consent can be withdrawn at any time with effect for the future

To exercise your rights, contact: unity.storm@reply.de

10. Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for us is:

Landesbeauftragte fuer Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestrasse 2–4
40213 Duesseldorf
Germany
https://www.ldi.nrw.de

11. Updates to This Privacy Policy

This privacy policy was last updated on 2026-03-06. We reserve the right to update this privacy policy to reflect changes in legal requirements or our data processing activities.