Privacy Policy

Last updated: August 5, 2026

1. Controller

The controller responsible for the processing of personal data on this website is:

TinyCloud GmbH
Connollystr. 8
80809 Munich
Email: agency@tinycloud.io
Phone: +498923780700

2. Executive Summary

This website is designed with data minimization in mind: it sets no cookies by default, does not embed third-party content upon loading, and creates no user profiles. We only process personal data to the extent technically necessary for the operation of the website or if you actively provide us with data — such as via the contact form or newsletter subscription.

3. Technical Provision of the Website (Hosting)

This website is operated via the TOBY platform by TinyCloud GmbH, Connollystr. 8, 80809 Munich, Germany. TinyCloud processes data on our behalf based on a data processing agreement pursuant to Art. 28 GDPR.

To deliver the website, TinyCloud utilizes the following service providers:

  • Cloudflare, Inc. (USA) — Content Delivery Network and website security. When accessing the website, Cloudflare processes your IP address and technical connection data for necessary technical purposes. Cloudflare is certified under the EU-U.S. Data Privacy Framework; in addition, the EU Commission’s standard contractual clauses are in place.
  • Hetzner Online GmbH (Germany) — Server operation.

The legal basis is our legitimate interest in the secure and reliable provision of the website (Art. 6(1)(f) GDPR). Connection data generated during delivery is only kept by the service providers for a short duration for security and operational purposes.

4. Reach Statistics Without Personal Data

To understand how often specific pages are visited, we maintain simple access statistics. No cookies are set, no statistics scripts are embedded on the page, and no IP addresses are stored. We only collect: accessed page, time, country of origin (broadly derived from the network connection), referring website (if available), and technical browser information. Attribution to individual persons is neither intended nor possible; cross-site tracking does not occur.

To the extent that personal data is processed in this context, the legal basis is our legitimate interest in the statistical analysis of the use of our website (Art. 6(1)(f) GDPR).

5. Cookies

This website does not set any cookies itself. Only if you activate embedded third-party content by clicking (see “Embedded Content” section) can the respective provider set their own cookies. You provide your consent for this directly through that click — a separate cookie banner is therefore not required.

6. Contact Form and Communication

If you contact us via the contact form or by email, we process the data you provide (e.g., name, email address, content of your message) to answer your inquiry. Messages submitted via the form are sent to us immediately via email and are not permanently stored on the website platform; only a content-free delivery receipt remains there. To protect against automated inputs, the form uses a cookie-less spam protection check that runs entirely on the platform itself and transmits no data to third parties.

The legal basis is Art. 6(1)(b) GDPR if your inquiry is aimed at a contract (e.g., appointment request, quote request), otherwise our legitimate interest in responding to inquiries (Art. 6(1)(f) GDPR). We delete the correspondence as soon as it is no longer required for processing and no statutory retention obligations prevent this.

7. Newsletter

To receive our newsletter, you must subscribe with your email address. Registration uses the double-opt-in process: you will first receive a confirmation email and will only be added to the distribution list after clicking the confirmation link. The time of registration and confirmation, as well as the IP address used during confirmation, are logged to verify the registration.

The legal basis is your consent (Art. 6(1)(a) GDPR). You may unsubscribe from the newsletter at any time via the unsubscribe link in any issue or by sending us a message; the lawfulness of the processing performed until the withdrawal of consent remains unaffected.

For delivery, we use Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg; service: Amazon SES) with processing in the EU region of Frankfurt. AWS is certified under the EU-U.S. Data Privacy Framework; in addition, standard contractual clauses are in place.

8. Embedded Content (Only After Your Click)

This website may offer embedded content from third-party providers at individual points, e.g., videos from external providers. Such content is not automatically loaded. You will initially only see a placeholder; a connection to the servers of the respective provider is only established when you click on “Show Content”. At this point, the provider receives your IP address and may set its own cookies. Depending on the provider, data may be transferred to the USA; the listed providers are certified under the EU-U.S. Data Privacy Framework.

The legal basis is your consent, which you provide through your click (Art. 6(1)(a) GDPR). Without a click, no data is transmitted to the providers. Further details are provided in the privacy policy of the respective provider.

9. Your Rights

Regarding the personal data concerning you, you have the following rights against us:

Right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), and data portability (Art. 20 GDPR). You may withdraw granted consents at any time with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): To the extent that we process data based on legitimate interests, you may object to this processing at any time for reasons arising from your particular situation.

To exercise your rights, an informal message to the contact details listed above under “Controller” is sufficient.

Additionally, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example with the authority responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

10. Storage Duration

Unless otherwise stated in this policy, we only store personal data as long as it is necessary for the respective purpose. Afterward, it will be deleted unless statutory retention obligations (e.g., from commercial or tax law) require longer storage; in such cases, processing will be restricted accordingly.

11. Changes to this Policy

We adapt this privacy policy if the website or the legal situation changes. The version published here at the time applies.