Privacy Notice for the Website poquito.ai

This privacy notice applies when you visit our website poquito.ai. The website provides information about Poquito; you cannot create an account or buy anything here. The Poquito app has a privacy notice of its own at poquito.ai/en/app/privacy. It also applies to the pages for deleting an account (poquito.ai/delete-account) and for withdrawing from the contract (poquito.ai/withdrawal).

1Who is responsible

Poquito Media UG (haftungsbeschränkt), Langhansstraße 86, 13086 Berlin, Germany, registered in the commercial register of the Local Court (Amtsgericht) Charlottenburg under HRB 278401. Questions about data protection: legal@poquito.ai

2Hosting the website (Vercel)

The website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Every visit produces connection data: your IP address, the date and time, the page requested, the page you came from, and details of your browser and operating system. We need them to deliver the website and to fend off attacks.

Vercel works on our behalf (Art. 28 GDPR) and also processes the data in the USA. Vercel is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR); standard contractual clauses apply in addition (Art. 46(2)(c) GDPR).

Legal basis: our legitimate interest in operating the website securely and reliably, Art. 6(1)(f) GDPR. Retention: Vercel keeps the logs for one day and then deletes them automatically.

3Background video (Vimeo)

The video on the home page is hosted by Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA, and is played from there. To do this, your browser connects to Vimeo; Vimeo receives your IP address and details of your browser, your device and the page you are on. We embed the player in “Do Not Track” mode: Vimeo then records no usage behaviour and sets no tracking cookies. The only cookies set are security cookies from Vimeo’s service provider Cloudflare, which fend off automated access (“__cf_bm” 30 minutes, “__cf_ob” until you close the browser, “cf_clearance” up to 1 year).

Vimeo processes the data in the USA. Vimeo is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

Legal basis: our legitimate interest in presenting our service clearly with a video, without video servers of our own, Art. 6(1)(f) GDPR; for the security cookies, Section 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). More: vimeo.com/privacy

4Cookie settings (CookieScript)

On your first visit we ask whether you allow the “Performance” category, that is, Google Analytics (section 5). The banner comes from CookieScript, a service of Objectis UAB, Laisves str. 60, LT-05120 Vilnius, Lithuania.

We store your choice in the cookie “CookieScriptConsent” on your device, so that we don’t have to ask again on every visit. So that we can prove how you decided, CookieScript stores a random identifier (the same as in the cookie), your decision and the categories chosen, the date and time, the page, the banner text shown, details of your browser and your IP address in shortened form (the last digits are set to zero). According to CookieScript, the full IP address is not stored.

Legal basis: for the cookie, Section 25(2) No. 2 TDDDG; for the record, Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. Retention: the cookie 30 days; the record for as long as we use CookieScript and must be able to prove a consent that was given. You can change your choice at any time via “Cookie settings” (“Cookie-Einstellungen” on the German site) at the bottom of the website.

5Google Analytics (only with your consent)

Only if you agree to the “Performance” category do we load Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Without your consent, Google Analytics is not loaded and no data goes to Google.

With Google Analytics we see which pages are visited, how visitors came to the website (for example through a search engine or a link), with which device and browser, and roughly from where (country, region, city). For this, Google sets the cookies “_ga” and “_ga_<ID>”, which are valid for 13 months.

According to Google, your IP address is not stored: for visitors from the EU, only the approximate location is derived from it on servers in the EU, after which it is discarded. Google Signals, advertising features and the link to Google Ads are switched off. Google works on our behalf (Art. 28 GDPR) and may transfer data to the USA. Google is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

Legal basis: your consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time with effect for the future via “Cookie settings”. Retention: Google deletes the analytics data 2 months after your last visit.

6Audience measurement without cookies (Vercel Web Analytics)

We also count page views with Vercel Web Analytics. No cookies are set and nothing is stored on your device. Visits are recognised by a hash value derived from the request, which is discarded after 24 hours. What is recorded: the page visited and the previous page, the approximate location, and the device type, browser and operating system. We see only aggregated figures, never individual visitors. Provider and transfer to the USA as in section 2.

Legal basis: our legitimate interest in improving the website, Art. 6(1)(f) GDPR.

7When you write to us

If you send us an email, we process your details in order to answer your enquiry. Our mailboxes are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, which works on our behalf.

Legal basis: our legitimate interest in answering enquiries, Art. 6(1)(f) GDPR; where it concerns a contract with us, Art. 6(1)(b) GDPR. Retention: until the enquiry has been dealt with; longer only where a statutory retention obligation applies.

8What we do not do on the website

No advertising tracking: no Meta Pixel, no Conversions API, no Google Ads or remarketing tag, no sharing with advertising networks. The pages for deleting an account and for withdrawing from the contract, and the app’s legal texts, load neither Google Analytics nor Vercel Web Analytics nor the cookie banner. Our fonts are hosted on our own servers.

9Your rights

You can ask us for:

• access to your data (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• your data in a common, machine-readable format (Art. 20 GDPR).

You can withdraw a consent at any time with effect for the future (Art. 7(3) GDPR); whatever happened until then remains lawful. To do so, write to us at legal@poquito.ai.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us, the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, datenschutz-berlin.de.

10Right to object (Art. 21 GDPR)

Where we base processing on our legitimate interest (sections 2, 3, 6 and 7), you can object at any time on grounds relating to your particular situation. We will then no longer process the data, unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

You can send your objection informally to legal@poquito.ai.