Privacy Policy

1. Who is responsible

The controller for data processing on this website is:

Sascha Lang Consulting Verwaltung GmbH

Julius-Hatry-Str. 1

68163 Mannheim

Germany

Managing Director: Sascha Lang. Commercial register: Amtsgericht Mannheim, HRB 740044. Tirvio is a brand of this company.

For any question about this policy, and for every request about your own data, email sascha@tirvio.com. Further details are in the Impressum.

We have not appointed a data protection officer, as we are not required to under Art. 37 GDPR and § 38 BDSG.

2. Scope

This policy covers the pages under tirvio.com: the home page, /saas-outbound-engine, /recruiter-pipeline-engine, /services-outbound-engine, /pricing, /results, /impressum and this page. It also covers the business contact data we process for our own outbound outreach (section 7).

It does not cover data we process on behalf of our clients. In those campaigns the client is the controller and their privacy policy applies.

3. Hosting and server logs

This site runs on Cloudflare Pages and is served through Cloudflare's content delivery network. DNS for tirvio.com is also on Cloudflare. When you load a page, Cloudflare processes technical request data including your IP address, the requested URL, referrer, user agent and the time of the request, in order to deliver the site and protect it against attacks and abuse.

Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, acting as our processor under Art. 28 GDPR. Legal basis: our legitimate interest in a secure and reliable website, Art. 6(1)(f) GDPR. Traffic is encrypted with TLS.

4. Website visitor identification (GetLeads)

We run a script on tirvio.com that evaluates visits and, where a match is available, determines the company and individual business contacts behind a visit. The purpose is to learn which businesses are interested in Tirvio and to follow up with them commercially.

What the script collects in your browser

The script automatically records page views, clicks, scroll depth, exit intent, form submissions, file downloads, copy events, idle time and video interactions. What is transmitted includes the page URL and title, referrer, screen size, timestamp, a session identifier and a user identifier, and, for click and copy events, the text of the element concerned. Your IP address is inherent in the request.

Where the data goes

Events are sent to api.sitelytics.tech, the technical service behind the pixel (Delivr). Requests are sent with credentials, so that service can set and read its own cookies. Its response can load up to three further counting pixels from other providers, which serve to match identifiers. Where an identifier exists, a script from pxdrop.lijit.com (Sovrn) is loaded as well; if it returns hashed email addresses, those are sent back to the service in hashed form to attribute the visit to a person.

From this matching we may receive, for an identified person, their name, job title, work email address and LinkedIn profile, together with the employer's name, domain, industry, size and region, and the pages visited with timestamps.

The processor is GetLeads (getleads.io), which integrates the services named above. Processing takes place in the United States. GetLeads privacy policy: getleads.io/privacy.

Consent for visitors in the EU, EEA, UK and Switzerland

If you are in one of those regions, we load the script only after you have explicitly agreed in the banner. Until you agree, nothing is loaded, nothing is sent to the services named above, and nothing is accessed on your device. If you decline, it stays that way. If Global Privacy Control or Do Not Track is set in your browser, we treat that as a refusal and do not ask at all.

We use your device time zone to work out where you are. If it cannot be determined, we treat you as an EU visitor and ask. This check relies on what your browser reports and is not infallible; it is deliberately built in your favour.

For visitors outside those regions we load the script without a banner on the basis of our legitimate interest. Identification itself is carried out by the provider only for visitors located in the United States.

You can change your decision at any time through "Cookie settings" at the bottom of every page. Withdrawal takes effect immediately and the script is no longer loaded.

Legal basis and objection

For visitors in the EU, EEA, UK and Switzerland the legal basis is your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future. The lawfulness of processing before withdrawal is unaffected. For visitors outside those regions it is our legitimate interest in acquiring business contacts and in direct marketing of our services, Art. 6(1)(f) GDPR.

As we do not collect this data from you directly, we note under Art. 14 GDPR that the attribution originates from the data holdings of the services named above and from publicly available business sources.

You can object at any time and request access, informally, at sascha@tirvio.com. We will then stop processing your data for this purpose and delete the record. The providers involved offer no opt-out link; requests go to that address or through "Cookie settings" in the footer.

5. Cookies and access to your device

The pages themselves set no cookies. We store a single item in your browser's local storage, namely your decision from the banner, under the key tirvio_consent_visitor_id with the value "granted" or "denied". This storage exists solely to respect your decision and not ask you again; it is strictly necessary for that and therefore requires no consent. You can remove it by clearing site data in your browser.

Any further access to your device comes solely from the script described in section 4 and, if you are in the EU, EEA, UK or Switzerland, happens only after your consent.

You can block or delete cookies and site data in your browser at any time. The site keeps working without them.

6. Contacting us and booking a call

If you email us, whether directly or through one of the email links on this site, we process your address, your message and any details you send us in order to answer you and, where it leads to one, to prepare and run the engagement. Legal basis: Art. 6(1)(b) GDPR for steps taken at your request before a contract, otherwise Art. 6(1)(f) GDPR. Our business email runs on Google Workspace (Google Ireland Limited).

Booking links on this site point to Cal.com. If you follow one, the booking happens on Cal.com's platform and their privacy policy applies to what you enter there. We receive the booking details, meaning your name, email address, chosen time and anything you write into the booking form. No booking widget is embedded in these pages, so nothing is sent to Cal.com until you click through.

7. Business contact data for our own outreach

We run cold email outreach for our own client acquisition. For this we process business contact data of people in their professional capacity: name, job title, employer, business email address, public profile links, and firmographic data about the employer such as industry, size, location and open roles. The data comes from publicly available sources and from commercial B2B data providers (Art. 14 GDPR).

Legal basis: our legitimate interest in direct marketing to businesses, Art. 6(1)(f) GDPR. We do not seek out data about people's private lives and we do not process special categories of personal data under Art. 9 GDPR.

Every message carries an opt-out. You can also object at any time, informally, at sascha@tirvio.com, and we will delete your record. You do not need to explain why.

8. Recipients

We pass personal data to service providers that process it on our behalf: hosting and CDN (Cloudflare), visitor identification (GetLeads with the services named in section 4), email and office software (Google Workspace), scheduling (Cal.com), the sending infrastructure for our outreach, and our tax and legal advisers. Beyond that we disclose data where we are legally required to.

9. Transfers outside the EU

Several of the providers named above process data in the United States. Such transfers rest on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, otherwise on the EU Standard Contractual Clauses together with additional measures, and in the case of visitor identification additionally on your consent. You can request a copy of the safeguards at sascha@tirvio.com.

10. How long we keep data

Records of identified visitors and of prospects are kept for as long as the contact is a plausible prospect, and reviewed at the latest after 24 months. Email correspondence is kept for as long as needed to handle the matter, and longer where statutory retention periods under German commercial and tax law apply, typically 6 or 10 years. Server logs held by our host are subject to their standard retention. Anything we no longer need, and anything you ask us to delete, is deleted.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and, where processing rests on consent, to withdraw it at any time (Art. 7(3)).

You also have the right to object at any time to processing based on our legitimate interests, in particular the visitor identification in section 4 and the outreach in section 7 (Art. 21 GDPR). Where you object to direct marketing, we stop, with no balancing test.

To exercise any of these, email sascha@tirvio.com. You do not need an account with us.

You also have the right to lodge a complaint with a supervisory authority. Ours is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

No automated decision-making producing legal effects within the meaning of Art. 22 GDPR takes place.

12. Changes

We update this policy when our tooling or our processing changes. The date at the top shows the current version.