Privacy Policy

a) Website Operation and Security

Data: IP address, browser/device data, timestamps, and server logs

Purpose: Ensure website stability, prevent misuse, monitor performance

Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in secure, functional website)

Retention: 14 to 30 days unless longer retention is required for incidents

b) Essential Cookies

Data: Technical identifiers needed to operate the site

Legal basis: §25 (2) TTDSG and Art. 6 (1)(f) GDPR

Retention: Session or up to 12 months

Non-essential cookies (analytics, marketing) are only set after consent via our cookie banner.

c) Analytics (Google Analytics 4)

Data: Usage data, pseudonymous identifiers, device and browser info

Legal basis: Consent (§25 (1) TTDSG + Art. 6 (1)(a) GDPR)

Provider: Google Ireland Ltd., with transfers to the U.S. under SCCs and the EU-US Data Privacy Framework

Settings: IP anonymized, Consent Mode activated, retention 2 to 14 months

Opt-out: Through cookie banner or browser add-on

d) Contact Forms and Email Inquiries

Data: Name, email, company, message, metadata

Purpose: Respond to your inquiry or follow up on business interests

Legal basis: Art. 6 (1)(b) GDPR (if pre-contractual), otherwise Art. 6 (1)(f) GDPR

Retention: 12 months after last interaction unless statutory obligation applies

e) Appointment Scheduling (Calendly)

Data: Name, email address, selected time slot, any information you provide in the booking form

Purpose: Schedule and manage consultation calls

Legal basis: Art. 6 (1)(b) GDPR (pre-contractual measures) and Art. 6 (1)(f) GDPR (legitimate interest in efficient scheduling)

Provider: Calendly LLC (USA), data processed under SCCs and the EU-US Data Privacy Framework

Retention: 12 months after the last scheduled appointment unless a business relationship is established

f) Website Hosting

Data: IP address, browser and device information, access logs

Purpose: Hosting and delivery of website content

Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in a reliable, performant website)

Provider: Cloudflare, Inc. (USA), via Cloudflare Pages. Content is served through Cloudflare's global edge network, including locations within the EU. Where personal data is transferred to the USA, the transfer is based on the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. A Data Processing Addendum is in place with Cloudflare.

Retention: As determined by server log retention (typically a few days to 30 days)

g) Recruiting and EOR Services

Data: CV, profile information, education, work history, references, salary expectations

Purpose: Assess candidates, connect with clients, maintain talent database

Legal basis: Art. 6 (1)(b) GDPR (for placement process) and Art. 6 (1)(f) GDPR (legitimate interest in staffing services)

Retention: 6 months after application if not hired; longer only with your consent to join our talent pool

h) Marketing and Newsletter Communications

Data: Name, email, interactions with emails and campaigns

Legal basis: Art. 6 (1)(a) GDPR (consent)

Opt-out: At any time via unsubscribe link or email to admin@scope-merge.com

Retention: Until withdrawal of consent or 24 months of inactivity