Privacy

This policy explains which personal data we process when you visit this website or sign up for early access to Bihsa, why we do it, and what rights you have. We keep data collection to what the website needs.

We do not ask for, and do not want to receive, information about your health through this website. Please do not include such information when you write to us.

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

Kolja Walden
Bihsa
Baumeisterstraße 14
12159 Berlin
Germany

Email: hello@bihsa.com
Phone: +49 176 444 679 05

We are not required to appoint a data protection officer. For any question about your data, contact us at the address above.

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15 GDPR)

• rectification of inaccurate data (Art. 16 GDPR)

• erasure of your data (Art. 17 GDPR)

• restriction of processing (Art. 18 GDPR)

• data portability (Art. 20 GDPR)

• withdraw your consent at any time, with effect for the future (Art. 7(3) GDPR). Withdrawal does not affect the lawfulness of processing carried out before it.

• lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany, mailbox@datenschutz-berlin.de

Right to object (Art. 21 GDPR). Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise any of these rights, an email to hello@bihsa.com is enough.

This website is hosted on Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.

When you open the website, your browser automatically sends information to Cloudflare's servers so the page can be delivered. This includes your IP address, date and time of the request, the page requested, the referring URL, browser type and version, and operating system. Cloudflare also uses this data to protect the website against attacks and misuse, and may set technically necessary security cookies for that purpose.

• Purpose: delivering the website securely and reliably.

• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a website that works and is protected against attacks. Storing or reading technically necessary information on your device is based on § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

• Recipient: Cloudflare acts as our processor under a data processing agreement (Art. 28 GDPR).

• Transfer to third countries: data may be processed in the USA. Cloudflare, Inc. is certified under the EU–US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). Cloudflare additionally offers standard contractual clauses.

• Storage: log data is kept only as long as needed for these purposes, as set out in Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

All fonts, scripts and videos on this website are served from our own hosting. Opening the page does not connect your browser to other providers such as Google Fonts or external video platforms.

If you contact us by email or phone, we process the information you give us — usually your name, email address or phone number, and the content of your message — to answer your request.

• Legal basis: Art. 6(1)(b) GDPR where your request relates to a contract or steps before one; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering messages we receive.

• Storage: we delete your message once your request is fully dealt with, unless statutory retention obligations require us to keep it longer.

Bihsa is not available yet. You can leave your email address on this website to hear from us when early access opens.

What we process: your email address, the time of sign-up and confirmation, and the IP address used at each step.

Double opt-in: after you sign up, we send you an email asking you to confirm. You are only added to the list once you click the confirmation link. We record the time and IP address of sign-up and confirmation so that we can prove your consent. Sign-ups that are not confirmed are deleted after 30 days.

What you receive: emails about early access to Bihsa and the product's progress. In the confirmation email we may ask you what brought you here. Answering is voluntary; if you reply, we use your answer to understand which topics interest people and to shape the product.

• Legal basis: your consent, Art. 6(1)(a) GDPR. Recording the confirmation is based on Art. 6(1)(f) GDPR, our legitimate interest in being able to prove your consent.

• Withdrawal: you can unsubscribe at any time through the link in every email or by writing to hello@bihsa.com.

• Storage: we keep your email address until you unsubscribe, then delete it. We may keep the record of your consent for up to three years afterwards to be able to prove it was given (§ 195 German Civil Code, BGB). A blocklist entry may be kept to make sure you are not contacted again.

• Email service provider: sign-ups are stored and emails are sent via Brevo, a service of Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France. Brevo acts as our processor under a data processing agreement (Art. 28 GDPR). Brevo stores data on servers within the European Union. Where Brevo's sub-processors access data from outside the EU, Brevo safeguards the transfer through the EU–US Data Privacy Framework or standard contractual clauses (Art. 45, 46 GDPR). Privacy policy: https://www.brevo.com/legal/privacypolicy/

• Form submission: your email address is passed to Brevo through a small server function running on our Cloudflare hosting (see §4). It is not stored there.

Measuring opens and clicks: our emails contain a small tracking pixel and tracked links. They tell us whether an email was opened and which links were clicked, together with the time and your approximate location and device type. We use this only in aggregate, to see which topics interest people and to improve our emails. This is part of the consent you give when signing up (Art. 6(1)(a) GDPR, § 25(1) TDDDG) and ends when you unsubscribe.

With your consent, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Google Analytics helps us understand how visitors use this website — for example, which platform they came from, how far they scroll, and how many sign up — so we can improve the page. For this, Google Analytics stores cookies on your device and processes usage data such as pages viewed, time spent, interactions, approximate location (country or region), device and browser information, and the referring website. Google Analytics 4 does not log or store full IP addresses of users in the EU.

We have configured Google Analytics as follows:

• Google Analytics only loads after you have given consent in our cookie banner.

• Google Signals and ads personalisation are disabled.

• Granular location and device data collection is disabled.

• Event data is automatically deleted after 2 months.

Cookies used:

• Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time via "Cookie settings" at the bottom of every page.

• Recipient: Google acts as our processor under a data processing agreement (Art. 28 GDPR).

• Transfer to third countries: Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU–US Data Privacy Framework (Art. 45 GDPR). Google also relies on standard contractual clauses.

• More information: https://business.safety.google/privacy/ and https://policies.google.com/privacy

We use a consent banner to ask for your permission before any non-essential cookies are set. The banner runs on our own hosting; no external consent provider is involved.

To remember your choice, the banner stores a small cookie (cc_cookie) on your device containing your selection and the time you made it. It is kept for 6 months, after which we ask again. You can change your choice at any time via "Cookie settings" at the bottom of every page.

• Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR, our obligation to be able to demonstrate consent, and § 25(2) no. 2 TDDDG.

This website links to our profiles on Instagram, TikTok, LinkedIn and X. These are plain links. No data is sent to these platforms when you open our website. Only when you click a link does the respective platform receive data from you, under its own privacy policy:

• Instagram (Meta Platforms Ireland Limited): https://privacycenter.instagram.com/policy

• TikTok (TikTok Technology Limited): https://www.tiktok.com/legal/privacy-policy-eea

• LinkedIn (LinkedIn Ireland Unlimited Company): https://www.linkedin.com/legal/privacy-policy

• X (formerly Twitter): https://x.com/en/privacy

This website is served exclusively over an encrypted connection (TLS). You can recognise it by "https://" and the lock icon in your browser's address bar.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

We will update this policy when the website, our services or the law change. The current version is always available on this page.