This notice explains how Phaseform GmbH processes personal data when you visit this website, contact us, request a quotation or document, subscribe to our newsletter, apply for a job, or use a scheduling link.
1. Controller and contact
Phaseform GmbH
Georges-Köhler-Allee 302
79110 Freiburg im Breisgau
Germany
Phone: +49 761 216 0800 0
Email: info@mail.phaseform.com
Website: www.phaseform.com
You may use these contact details for any question about this notice or to exercise your data-protection rights.
2. Website delivery and security
When you request a page, your browser necessarily sends the IP address of your device, the date and time, the requested address, the referring page where supplied, browser and operating-system information, and the amount of data transferred. We process these data to deliver the website and to maintain its security and availability. The legal basis is our legitimate interest in operating a secure and reliable website (Art. 6(1)(f) GDPR).
The website is provided through Cloudflare Pages. Cloudflare also protects it against attacks and automated abuse. Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, and its relevant European affiliate process these data for us under a data-processing agreement. We do not maintain our own persistent visitor log. Cloudflare may retain limited security and operational records in accordance with our configuration and its contractual retention rules.
Abuse control on the forms. To protect the quotation and document forms against automated misuse, we count the recent submissions received from each visitor. We do not store your IP address for this purpose. The address is converted into a shortened one-way hash using a secret value held by us, and only that hash, a time window and a counter are stored. The hash is not linked to your quotation, document-request or newsletter record, is not used for any other purpose, and does not allow us to identify you from our records. The legal basis is our legitimate interest in protecting the forms and the systems behind them against automated abuse (Art. 6(1)(f) GDPR). Expired counters are reviewed and deleted at least quarterly.
Fonts, images, videos and other page assets are served from this website's own domain. We do not embed social-media plug-ins, maps, chat widgets, advertising networks or comparable resources that contact another provider merely because you opened a page. Google Analytics is the exception, and is loaded only after the consent described in section 7. The one video we offer is likewise not embedded until you press play (section 9).
3. Contact and quotation requests
If you contact us by e-mail or telephone, we process the contact details and message you provide so that we can respond. The legal basis is Art. 6(1)(b) GDPR where the enquiry concerns a contract or steps requested before a contract; otherwise it is our legitimate interest in responding to enquiries addressed to us (Art. 6(1)(f) GDPR).
The quotation form requires your first and last name, organisation, e-mail address, city and country. The products requested, field of work, telephone number, address, discount code and free-text message are optional. We use these data to understand the request, select the appropriate sales contact and prepare or discuss a quotation. The legal basis is Art. 6(1)(b) GDPR.
Your IP address, an IP-derived identifier and your browser identification are not stored in the quotation record itself. Form abuse control and Cloudflare’s edge-level protection work as described in section 2.
Quotation records that do not lead to a business relationship are reviewed at least quarterly and erased once they are more than 24 months old. Records connected with a contract are kept only as long as the business relationship and applicable commercial, tax or legal-claims retention requirements demand; depending on the kind of record, statutory periods may be six, eight or ten years.
4. Document requests
Some technical documents are available after you provide an e-mail address. We record the address, document and requesting page to manage access and understand professional interest in our documentation. We do not use the address for a sales or marketing follow-up unless you separately ask us to contact you or subscribe to the newsletter. The legal basis is our legitimate interest in distributing and evaluating the use of our technical documentation (Art. 6(1)(f) GDPR). You may object at any time using the contact details in section 1.
Your IP address, an IP-derived identifier and your browser identification are not stored in the document-request record itself; form abuse control works as described in section 2. Document-request records are reviewed at least quarterly and erased once they are more than 24 months old. The optional newsletter choice is separate and is described in section 5.
5. Newsletter
You receive the newsletter only if you request it. We process your e-mail address and, where supplied with a quotation request, your name and organisation. The legal basis is your consent (Art. 6(1)(a) GDPR).
We use double opt-in. MailerLite first sends a confirmation message, and the address becomes eligible for newsletters only after the confirmation link is used. We review pending registrations at least quarterly and delete unconfirmed registrations older than three months. You may withdraw consent at any time using the unsubscribe link in every newsletter or by contacting us. Withdrawal does not affect processing before withdrawal. We retain the minimum record needed to demonstrate the consent and withdrawal for the applicable limitation period.
MailerLite Limited, Ground Floor, 71 Lower Baggot Street, Dublin 2, D02 P593, Ireland, provides subscription management and newsletter delivery under a data-processing agreement.
Newsletter measurement. We do not enable open tracking or Google Analytics campaign tracking for newsletters sent from 10 September 2026 onward. MailerLite can still record clicks on ordinary links because it rewrites them with a recipient identifier. Until that feature can be disabled or covered by a separate, optional consent, our newsletters do not contain those tracked links. MailerLite provides aggregate delivery, bounce and unsubscribe information needed to operate the list. Older campaigns used tracking pixels and measured links. We no longer retrieve or use their recipient-level interaction records; any such historic record is deleted when the associated subscriber record is deleted.
6. Applications
We process the contact details, CV, qualifications, correspondence and other information you submit to decide whether to establish an employment relationship. The legal basis is Art. 6(1)(b) GDPR, because the processing is carried out at your request in order to decide whether to enter into an employment contract, in conjunction with Section 26(1) sentence 1 BDSG. Where we process application data after the procedure has ended in order to establish, exercise or defend legal claims, the legal basis is Art. 6(1)(f) GDPR. Please do not provide special-category data within the meaning of Art. 9(1) GDPR unless they are necessary for the application; where such processing is necessary, it is based on Art. 9(2)(b) GDPR in conjunction with Section 26(3) BDSG.
You may apply by e-mail or through the Phaseform company page on JOIN. Merely following that external link opens a service operated by JOIN Solutions AG, Eichenstrasse 2, 8808 Pfäffikon SZ, Switzerland. JOIN's own privacy policy applies to its platform processing. Application data made available to Phaseform are accessible only to staff involved in recruitment and to service providers supporting our e-mail or recruiting systems.
If no employment contract is concluded, we normally erase the application six months after the process ends, unless longer storage is necessary to establish, exercise or defend legal claims. We keep an application for future vacancies only with separate consent, which may be withdrawn at any time. If an employment contract is concluded, necessary application data become part of the personnel record.
7. Google Analytics 4 — only after consent
We use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how visitors use the website and improve it.
No Google Analytics request is made before you consent. The Google tag is not loaded when you first open the website or after you decline. Only after you select “Accept analytics” do we load it and permit analytics storage. Google Analytics then processes pages viewed, time and approximate duration, approximate location derived from the IP address, referring page, browser, device and operating-system information, and interactions such as downloads and outbound links. Google Analytics 4 does not log or store IP addresses: according to Google, traffic from the European Union is received on European servers, where the address is used in transit to derive an approximate location and is then discarded. The address is not available to us. We do not enable Google Signals, advertising features, remarketing or cross-device tracking, and we do not combine Analytics data with quotation, download or newsletter records.
The legal basis for storing or reading information on your device is your consent under Section 25(1) TDDDG. The legal basis for processing the resulting personal data is your consent under Art. 6(1)(a) GDPR. Google processes the data for us under a data-processing agreement. Analytics data are retained for 14 months.
You may withdraw consent at any time through “Cookie settings” in the footer. Selecting “Decline” stops future Analytics collection and removes the Analytics cookies accessible to this website. Withdrawal does not affect processing before withdrawal. You can also remove both the consent choice and any cookies by clearing all site data for phaseform.com in your browser.
8. Scheduling with Calendly
For some trade fairs and conferences we link to an appointment page operated by Calendly LLC, 271 17th St NW, Atlanta, GA 30363, USA. Calendly is not embedded: no Calendly request is made unless you choose the external link.
If you book, Calendly receives the details entered there, including your name, e-mail address, selected time and answers to booking questions, and makes them available to us so that we can arrange the meeting. The legal basis is Art. 6(1)(b) GDPR for requested pre-contractual steps and otherwise our legitimate interest in organising appointments efficiently (Art. 6(1)(f) GDPR). Booking information is erased when the meeting and related contact have ended unless contractual or statutory retention requirements apply. You can cancel through the link in the booking confirmation. Calendly's privacy policy provides information about its own processing.
9. Video on the technology page
The technology page offers a video hosted on YouTube, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It is not embedded when the page loads. The page shows a preview image stored on our own server and a play button; no request reaches YouTube or any other Google server unless you press play.
If you press play, the player is loaded from youtube‑nocookie.com in privacy-enhanced mode. YouTube then receives your IP address and browser information and may store information on your device to play the video and measure playback. If you are signed in to a Google account, Google may associate the playback with that account. The legal basis for storing or reading information on your device at that point is your consent under Section 25(1) TDDDG, given by pressing play, and Art. 6(1)(a) GDPR for the resulting processing. If you do not press play, nothing is transferred. Google's privacy policy provides information about its own processing.
10. Recipients and international transfers
We do not sell personal data. Depending on the service you use, recipients are Cloudflare for website hosting, security, the form database and transactional e-mail; MailerLite for newsletters; Google for consented analytics; Calendly if you open its scheduling page; YouTube if you start the video on the technology page; JOIN if you open or use its recruiting platform; and providers supporting our company e-mail and office systems. We may also disclose information where required by law or necessary for legal claims.
Some providers or their subprocessors may process personal data outside the European Economic Area, including in the United States or Switzerland. Where the recipient is covered by an applicable European Commission adequacy decision, including an actively certified US participant in the EU–US Data Privacy Framework, the transfer relies on Art. 45 GDPR. Otherwise we use appropriate safeguards under Art. 46 GDPR, normally the European Commission's Standard Contractual Clauses, together with supplementary measures where required. You may request information about the applicable mechanism and a copy of the relevant safeguards using the contact details in section 1.
11. Local storage and cookies
We store your analytics choice in your browser's local storage so that we do not ask on every page. This choice is not transmitted to us. Its storage is necessary to provide the privacy setting you requested (Section 25(2)(2) TDDDG). Google Analytics cookies are set only after consent as described in section 7.
12. Your rights
Subject to the conditions in the GDPR, you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7(3)). You also have the right not to be subject to a decision based solely on automated processing where Art. 22 applies. We do not use automated decision-making or profiling that produces legal or similarly significant effects.
Where we rely on Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation. If personal data were ever processed for direct marketing, you could object to that use at any time without giving reasons.
13. Complaints
You may lodge a complaint with a data-protection supervisory authority. The authority responsible for Phaseform is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany; e-mail: poststelle@lfdi.bwl.de; website: www.baden-wuerttemberg.datenschutz.de.
14. Changes to this notice
This privacy policy was last revised on 11 September 2026. We update it when our processing or the applicable legal requirements change.