Privacy

1. Controller

2. What we process

• Webinar registration (double opt-in): name, company, email, consent, IP + timestamp. Legal basis: Art. 6 (1) (a) GDPR.
• Webinar viewing statistics: playback events (page view, start, progress in percent, completion), linked to confirmed registrations, evaluated internally in aggregate form. The video is hosted on our own infrastructure. No third-party video service is involved. Legal basis: Art. 6 (1) (f) GDPR; for registered users also Art. 6 (1) (b) GDPR.
• Roadmap inquiries: name, company, email, optional newsletter opt-in. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures).
• Newsletter (double opt-in): email, optionally name and company, signup and confirmation time, IP address and the exact consent wording. Content: insights on creatives and performance for e-commerce brands and occasional information on vanillasalt offers. Your subscription only becomes active after you click the confirmation link; if you tick the newsletter box during webinar registration, the click in the webinar confirmation email also confirms the newsletter, and that email says so explicitly. Data is stored in this website's database and may be transferred to our internal customer management system; emails are sent via our email service (see processors), with no disclosure to third parties for other purposes. Legal basis: Art. 6 (1) (a) GDPR; proof of consent: Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR. Stored until you unsubscribe (link in every issue); unconfirmed signups are deleted after 30 days; proof of given and withdrawn consent is kept for up to 3 years. No newsletter is sent yet and no tracking takes place; tracking pixels will only be used once the newsletter is sent.
• Briefing and onboarding forms: If you fill in one of our briefing forms, we process your details (contact data, information on your company, offer, target audience and communication, and where applicable a customer reference from your personal link) to prepare and carry out our collaboration. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures and performance of a contract) and your consent under Art. 6 (1) (a) GDPR. Until you submit, your entries are only stored locally in your browser and deleted there afterwards. After submission we store them on servers of our hosting and database provider in the EU (Ireland). You receive a confirmation email at the address provided. We keep the data for the duration of our collaboration and delete it no later than three years after it ends, unless statutory retention obligations apply. If no collaboration comes about, we delete it no later than six months after receipt. You can withdraw your consent at any time with effect for the future by emailing eik@vanillasalt.agency.
• Server logs: anonymised access data for security. Legal basis: Art. 6 (1) (f) GDPR.
• Analytics (Plausible & Google Analytics 4): Plausible is cookieless and EU-hosted; GA4 (Google Ireland Limited, property vanillasalt.agency, measurement ID G-FYSV7XZ9LB) is only loaded after consent to the "Statistics" category (Google Consent Mode v2, default: denied). Legal basis: Art. 6 (1) (a) GDPR, § 25 (1) TDDDG.
• Meta Pixel (Meta Platforms Ireland Limited): measures ad performance (Meta/Facebook/Instagram); events: page view and completed webinar registration. Only active after consent to the "Marketing" category. Legal basis: Art. 6 (1) (a) GDPR, § 25 (1) TDDDG.
• Meta Conversions API (Meta Platforms Ireland Limited): if you have consented to marketing cookies, after you confirm your webinar registration we additionally transmit the following data to Meta server-side: your email address as a SHA-256 hash, your IP address, your browser identifier (user agent), the Meta cookie identifiers (_fbp, _fbc) and the time of registration. Purpose: measuring the performance of our ads. Legal basis: your consent, Art. 6 (1) (a) GDPR, which you can withdraw at any time via the cookie settings.

3. Processors and third-country transfers

• Cloudflare, Inc. (DNS/CDN, USA): safeguarded via EU Standard Contractual Clauses and the EU–US Data Privacy Framework.
• Lovable (hosting, transactional email, database, webinar video delivery): EU processing under DPA.
• Meetergo GmbH (booking, Germany).
• Plausible Analytics (analytics, EU).
• Google Ireland Limited (Google Tag Manager, Google Analytics 4): GTM loads the tags listed above only after consent; possible US transfer under the EU–US Data Privacy Framework.
• Meta Platforms Ireland Limited (Meta Pixel, only after marketing consent): possible US transfer under the EU–US Data Privacy Framework.

4. Your rights

You have the right to access, rectification, erasure, restriction, data portability, objection and to lodge a complaint with a supervisory authority (Art. 15–22, 77 GDPR). To exercise any right, email eik@vanillasalt.agency.

5. Cookies

Statistics and marketing cookies or pixels (Google Analytics 4, Meta Pixel) are only set after your explicit consent via the cookie banner. Without consent they stay inactive (Google Consent Mode v2, default: denied). Plausible analytics is cookieless. Strictly necessary cookies may be set by embedded services like Meetergo when you actively use them. You can change or withdraw your consent at any time via the cookie settings in the footer.