Privacy Policy

Credon
Maximilian Hüls and Victor Bruognolo, partnership under German civil law (GbR)
Wiesenstraße 4A
13357 Berlin
Germany
Email: hello@credon.pr

We have not appointed a data protection officer. We are not required to do so under Article 37 GDPR or Section 38 BDSG.

• Visiting the site produces server log data, which our hosting provider processes so the site can be delivered and kept secure.
• Sending the contact form stores what you typed, so we can answer you.
• We use no analytics, no advertising cookies, no cross-site tracking and no social media plugins.
• Fonts are delivered from the same server as this site. Loading a page makes no request to Google or any other font provider.

This website is hosted by Lovable Labs Incorporated, 1 Lincoln Street, Boston, MA 02111, United States ("Lovable"), which acts as our processor under Article 28 GDPR.

Each time the site is accessed, the hosting infrastructure automatically records data that your browser transmits:

• IP address of the requesting device
• Date and time of the request
• The page or file requested, and the amount of data transferred
• Referring URL, browser type and version, operating system

Legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the technically error-free delivery and the security of this website. This data is not merged with other sources and is not used by us to identify you. It is retained only for as long as it is needed for the security and error analysis of the hosting infrastructure and is then deleted in accordance with Lovable's retention policy.

Lovable is based in the United States and uses sub-processors in several countries. Where personal data is transferred outside the European Economic Area, the transfer is based on the European Commission's Standard Contractual Clauses. Lovable publishes its current list of sub-processors at trust.lovable.dev/subprocessors.

If you use the contact form, we process the information you enter: your name, your company, your email address and your message.

The form also contains a hidden field that is used to detect automated spam submissions. Human visitors do not see or fill in this field.

Submissions are stored in a database that is part of our hosting environment. The database runs on infrastructure provided by Supabase, which Lovable engages as a sub-processor. Data may be processed in the United States; the transfer is based on Standard Contractual Clauses.

Purpose and legal basis

We process this data solely to answer your enquiry and, where relevant, to prepare a possible engagement. Legal basis is Article 6(1)(b) GDPR for steps taken at your request prior to entering into a contract, and otherwise Article 6(1)(f) GDPR, our legitimate interest in responding to enquiries addressed to us.

Retention

We delete enquiries six months after the matter is closed, unless a contractual relationship results. In that case, statutory retention periods under commercial and tax law apply, which are up to ten years.

Voluntary

Providing this data is neither required by law nor by contract. Without it we cannot answer you, but there is no other consequence.

If you write to us directly, we process your email address, your name and the content of your message in order to reply. Our email is handled by Google Ireland Limited (Google Workspace), Gordon House, Barrow Street, Dublin 4, Ireland, which acts as our processor. Google may process data in the United States; the transfer is covered by the EU-US Data Privacy Framework, under which Google LLC is certified, and additionally by Standard Contractual Clauses. Legal basis is Article 6(1)(b) GDPR where the message concerns a possible engagement, otherwise Article 6(1)(f) GDPR. Retention is as set out in section 4.

We do not use analytics, advertising cookies, cross-site tracking or visitor profiling.

Information is stored on or read from your device only where this is strictly necessary to deliver the site you requested: a technical cookie set by the hosting platform to route your request correctly, and short-lived entries in your browser's session storage that remember whether you have already seen the site's intro animation and where you were on a page when you navigate back. This storage is permitted under Section 25(2) No. 2 TDDDG without consent. It is not used to recognise you across separate visits.

All typefaces used on this site are delivered from the same server as the site itself. No connection is made to Google Fonts or any other external font service, and no data is transmitted to such a provider when you load a page.

This site links to external websites, for example media outlets and LinkedIn profiles. These are plain links. No content from those sites is loaded and no data is sent to them until you click a link. From that moment, the privacy policy of the respective provider applies.

We do not sell personal data and we do not pass it to third parties for their own purposes. Data is accessible to:

• Lovable Labs Incorporated and its sub-processors, including Supabase, for hosting the site and storing contact form submissions
• Google Ireland Limited (Google Workspace), for email correspondence
• public authorities, where we are legally obliged to disclose

Lovable and our email provider act on our instructions under data processing agreements pursuant to Article 28 GDPR.

Under the GDPR you have the right to:

• access the personal data we hold about you (Article 15)
• have inaccurate data corrected (Article 16)
• have your data erased (Article 17)
• have processing restricted (Article 18)
• receive your data in a portable format (Article 20)
• withdraw any consent you have given, with effect for the future (Article 7(3))

Right to object, Article 21 GDPR

Where we process data on the basis of Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

To exercise any of these rights, write to hello@credon.pr. You do not need to give a reason and it costs you nothing.

Right to lodge a complaint, Article 77 GDPR

You may complain to a supervisory authority, in particular in the member state of your residence, place of work or the place of the alleged infringement. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), datenschutz-berlin.de.

We do not use automated decision-making, including profiling, within the meaning of Article 22 GDPR.

We update this policy when the site or the services behind it change. The version in force is the one published here.