Privacy policy

Controller

PinkStone Ventures GmbH
Neue Schönhauser Str. 3–5
10178 Berlin, Germany
Contact details: Imprint

This website

This policy applies to philipp-neuberger.com. Images and fonts are served locally. We use our own Firstload analytics installation, without cookies by default. No advertising services are loaded. The language is determined by the URL and is not stored in your browser.

Hosting and connection data

The website is hosted by Vercel (Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA). Requests involve connection data such as your IP address, browser information, time and requested URL. This is needed to deliver, diagnose and secure the website. The legal basis is our legitimate interest in secure operation under Art. 6(1)(f) GDPR. Processing is governed by a data processing agreement. See the Vercel privacy policy and data processing agreement.

Contact and email delivery

When you use the form, we process your first name, last name, email address and message, plus any company or telephone details you choose to provide. Acknowledging the privacy notice is not consent to advertising or analytics. We use these details to handle and respond to your enquiry. The legal basis is Art. 6(1)(b) GDPR for contractual or pre-contractual enquiries, and otherwise Art. 6(1)(f) GDPR based on our legitimate interest in communicating with you. Required details are needed to submit the form. You can also contact us directly by email.

Postmark

Your message is sent through Postmark, a service of ActiveCampaign, LLC, 1 N Dearborn St, 5th Floor, Chicago, IL 60602, USA. It is addressed to Philipp Neuberger and copied to the operator’s service mailbox; any additional configured internal copy is also used only to handle the enquiry. Your email address is used as the reply address. Open and link tracking are disabled for these messages. There is no automatic newsletter subscription or direct CRM transfer. See Postmark and EU privacy for processing and US transfer information.

Spam protection with Cloudflare Turnstile

Pages with a contact form use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Cloudflare processes information including your IP address, browser and device signals to detect automated requests. The result is validated by our server before sending; the content of your message is not sent to Turnstile. Processing is based on our legitimate interest in preventing spam and abuse under Art. 6(1)(f) GDPR. Where necessary access to your device is involved, this serves to provide the requested form under Section 25(2)(2) TDDDG. You can email us directly if you prefer not to use this check. See the Cloudflare privacy policy and Turnstile privacy addendum.

Abuse prevention and retention

The form server also limits request frequency. It uses a hash of the network address, without form content, in the memory of each server instance for a ten-minute window; expired entries are removed during subsequent requests. Correspondence is retained for as long as needed to handle your enquiry or any resulting contract. It is then deleted unless legal retention duties or legitimate reasons such as resolving claims require otherwise. Technical operational data is processed for security and diagnostic purposes.

Recipients and international transfers

Data is accessible to the operator’s staff handling your enquiry and the technical providers described above. Vercel, Postmark and Cloudflare may process data outside the EU or EEA, particularly in the USA. Transfers are subject to Art. 44 et seq. GDPR, including applicable adequacy decisions or standard contractual clauses. You can request details of the safeguards using the contact address above; the linked provider information describes their agreements.

Firstload web analytics

We operate Firstload at firstload.fastercode.studio to understand reach, content engagement and paths to an enquiry. It records page paths without arbitrary query parameters or fragments, page titles, referring domains, campaign parameters and click IDs where present, coarse browser/device information and interactions such as scrolling, active time, disclosures, link clicks and form progress. Search terms, form contents, names, email addresses, phone numbers and hashes derived from them are not sent to Firstload. Contact success is recorded only after confirmed acceptance of the message.

Without cookies, Firstload uses a random identifier in page memory and a site-specific HMAC derived from IP address and browser user agent, with a key that changes at midnight UTC each day. The IP address and full user agent are processed for this purpose but are not stored in the analytics record. Recognition is a pseudonymous estimate, not a guaranteed person identity. Only after consent is the existing identity persisted in a cookie; additional information such as screen/viewport dimensions, language and timezone is then collected. Cookie-free measurement is not equivalent to anonymous data. Analysis serves our interest in improving content and contact options under Art. 6(1)(f) GDPR. Optional persistent recognition and additional device signals rely on your consent under Art. 6(1)(a) GDPR and, for the cookie, Section 25(1) TDDDG. You can disable analytics below.

Cookies and browser storage

On your first visit, Firstload stores neither cookies nor identifiers in local or session storage. Only if you explicitly allow recognition in the analytics settings does Firstload set the signed first-party cookie <code>fl_uid</code> for up to 180 days; your browser may shorten this period. Your explicit preference is saved under <code>pn.analytics.preference</code> in this browser’s local storage for 180 days. It contains the choice, policy version and expiry, not a visitor identifier. Without a choice, no preference is saved either. “Disable analytics” stops further measurement and removes the Firstload cookie, allowing you to object or withdraw consent. “Measure without cookies” withdraws recognition consent and resumes cookie-free measurement. Previously stored events are not automatically deleted. Do Not Track and Global Privacy Control are respected. Acknowledging the contact form’s privacy notice is not analytics consent. The form also uses the Cloudflare Turnstile security check described above.

External links

Links to LinkedIn or project websites lead to separate services. These destinations are contacted only when you follow a link. The respective provider’s privacy policy applies there.

Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. You may withdraw consent at any time with future effect. To exercise these rights, use the contact details in the imprint. You may also lodge a complaint with a supervisory authority, including the Berlin Commissioner for Data Protection and Freedom of Information. No automated decision-making with legal or similarly significant effects takes place.

Updated: 6 November 2026.