Privacy policy

1. Controller

Sven Heese, trading as Sven Heese Consulting
Agrarstr. 39
39179 Barleben, Germany

Email: hello@engagebeat.de
Phone: +49 1514 193 44 21

This policy covers the sales website, the sample check-in, trial requests and contact enquiries. When using the team application, the following also apply: the information provided there about data processing and the information provided by your organisation.

2. Accessing and providing the website

When you access a page, connection data required for technical reasons is processed. This includes, in particular, your IP address, the time and target of the request, status messages, and information about your browser and operating system. This processing enables the page to be transmitted, errors to be analysed and protection against abusive access.

The website is hosted by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, on a server in Nuremberg. netcup provides the server infrastructure. A data processing agreement is in place with netcup. Information from the provider: Data protection at netcup.

The legal basis for the necessary provision and security is Article 6(1)(f) GDPR. Our legitimate interest is in a functioning and secure website. Connection data is required to retrieve the page. Technical logs are retained according to the need for error analysis and security incidents; further storage is considered only where there is a specific reason or a legal obligation.

HTTPS encryption and certificates

For the encrypted connection, we use certificates from Let’s Encrypt, a service of the Internet Security Research Group (ISRG), USA. When certificates are issued, renewed and checked, technical data such as domain names, server IP addresses and validation information is processed. Domain names and public certificate data are published in publicly accessible certificate transparency logs. Depending on the browser, certificate checks may also generate connection data.

This certificate and validation data may be processed outside Germany, particularly in the USA. Form contents and team feedback are not transmitted for certificate issuance. The private key remains on our server. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure, encrypted provision of the website. Information about retention periods and international transfers: Let’s Encrypt privacy notice.

3. Check-in, booking and contact form

The form itself shows whether the enquiry form is available. After successful submission, we confirm receipt on the website with a reference number.

Responses in the sample check-in and trial requests that have not yet been submitted remain in the open page’s working memory. They are discarded when you close or reload the page. The sample check-in does not ask for names or email addresses.

The form collects your name, business email address and organisation, plus an optional message. When you register for setup, it also collects the exact planned number of teams, the estimated size of the largest team, your preferred plan and billing option. A telephone number for queries is optional. Please do not enter responses or personal details of individual team members.

When you submit the form, this information is transmitted to the enquiry service over an encrypted connection. If it is successfully accepted, you receive a reference number. Registering for setup prepares your onboarding. It does not book a subscription or a trial. The binding booking, including prices and terms, takes place separately in the web app. General contact enquiries and EngageBeat Enterprise enquiries remain non-binding. If sending is unavailable, this is displayed. Without confirmed acceptance, the form does not display a successful receipt.

To ensure reliable processing, an accepted enquiry is stored in a sending queue on our netcup server in Nuremberg and passed to our IONOS contact mailbox over an encrypted SMTP connection. The receipt reference confirms storage, not email delivery. Within our server, the enquiry is transferred to the protected customer management system. After registering for setup, you receive an email with your personal setup link. For an existing company, authorised access is checked; a matching email domain or company name does not grant access rights. General contact and partner enquiries, as well as individual quotations, are handled personally. Company and billing details, including a separate billing email address and contact details for the contract and team owners, are added in the web app. A booking alone does not start a trial period. The trial starts only after setup is complete and the start has been approved. The start, end, charging start date, reminders and cancellations are recorded for contract performance. A random enquiry key prevents duplicate acceptance when the same enquiry is resubmitted. Protection against abuse uses input validation, a spam protection field and time-limited request restrictions, without an external CAPTCHA service. For request restrictions, a periodically changing, key-based identifier is generated from the IP address and retained for no more than 24 hours. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protection against automated abuse. This does not sign you up to a newsletter.

You can download the PDF guide without registering. Downloading it generates the same technical connection data as other files on the website.

4. Contact by form, email or telephone

When you contact us, we process your contact details and the content of your enquiry in order to handle your request. You decide what information to share. Without a way to contact you and information about your request, we may be unable to respond. An enquiry does not sign you up to a newsletter.

When you register, an entry source contained in the setup link, such as “Flyer” or “Article”, may be transmitted with the submitted details. We use it to categorise the registration. It is stored with the specific case only when you deliberately submit the form. The same deletion rules apply to this case information as to the associated enquiry. Separately, we count visits to the setup page and submitted registrations by predefined entry categories, as described in “Server-side audience and conversion measurement”. We do not use cookies for this, store anything permanently in the browser or record personal click paths.

For an enquiry aimed at entering into a contract with you, the legal basis is Article 6(1)(b) GDPR. We process other business contacts on the basis of Article 6(1)(f) GDPR; our legitimate interest is responding to incoming enquiries and business communication. We comply with statutory retention obligations on the basis of Article 6(1)(c) GDPR.

For sending form enquiries and for the mailbox hello@engagebeat.de we use IONOS Mail Basic from IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. A data processing agreement is in place with IONOS. The AI email assistant is not used. IONOS processes message content, sender and recipient details, and technical communication data to provide, deliver and secure the email service.

Information about data processing and subprocessors is available in the IONOS data processing agreement and the annexes linked there. In that agreement, IONOS provides for processing within the EU/EEA and, where required to provide the service, transfers to third countries under the conditions of Articles 44 et seq. GDPR. Exclusive processing of all communication data in Germany is therefore not guaranteed. Further information: Data protection at IONOS.

Appointment booking via Calendly

For optional appointment booking, we use Calendly, LLC, USA. The booking page opens in a new tab only after you select the link. No calendar is embedded in this website; visiting it does not load Calendly content. Alternatively, you can use our contact form.

To organise the conversation, your name, email address, booked time and any optional details about your enquiry are processed. Calendly processes this booking data on our behalf. Appointment data is also processed in the connected calendar and confirmation messages. Please do not transmit team responses or information about individual employees.

When you visit the Calendly page, the provider also processes technical connection and usage data and uses its own cookies or similar technologies. Calendly’s privacy notices and cookie settings apply there. Our statement that this sales website does not set analytics cookies does not apply to the external booking page.

Our processing serves to arrange an appointment and handle your enquiry. For pre-contractual steps at your request, the basis is Article 6(1)(b) GDPR; for enquiries as an organisation’s contact person, it is Article 6(1)(f) GDPR, with the legitimate interest in business communication. Booking an appointment does not sign you up to a newsletter.

Calendly processes data in the USA, among other places; appointment scheduling therefore does not take place exclusively in Germany. For transfers from the EEA, Calendly provides in its contractual terms for the EU–US Data Privacy Framework and, where required, standard contractual clauses. The data processing provisions form part of the customer terms. Details are available in the Calendly privacy policy and the Data Processing Addendum (data processing).

The conversation via Microsoft Teams

Introductory conversations take place via Microsoft Teams, provided by Microsoft Ireland Operations Limited. In particular, display names, appointment and participation data, technical connection data and any audio, video, chat or screen content you share are processed. You decide whether to turn on your camera or share content. Conversation content is accessible to the people involved; Microsoft provides the technical processing.

We do not record these conversations or create transcripts. Any chat messages, calendar data and appointment data may remain stored after the conversation; the retention rules below apply to content we manage. The legal bases stated for handling your enquiry also apply to conducting the conversation. Alternatively, you can discuss your enquiry using our contact form or by telephone.

Nor is processing exclusively in Germany guaranteed for Microsoft Teams and the connected Microsoft calendar services. Depending on the service, configuration and support case, transfers outside the EEA may take place. The relevant data protection terms and transfer mechanisms of the Microsoft agreement apply. Information: EU Data Boundary and exceptions and Microsoft privacy statement.

Booking data we manage for enquiries that do not lead to a business relationship is subject to a retention period of 90 days after the matter is concluded, unless a subsequent business relationship or statutory retention obligation prevents this. The operator carries out deletion in Calendly and the associated calendar and mailbox copies. This does not constitute a promise of automatic deletion.

Server-side audience and conversion measurement

We count visits to specified public pages, including knowledge articles and the setup page, the guide, and redirects to the demo and appointment booking. For this purpose, the server processes the time of the request, a specified page path and broad, predefined categories. We count requests, not uniquely identified visitors. Multiple visits by the same person may be counted more than once.

We distinguish the source of a visit from the route to setup. The source category is derived from selected campaign details in the link or the referrer information sent by the browser, where available. Specified campaign details take priority over referrer information. When the setup page is accessed, the setup entry point might be “Demo”, “Knowledge article” or “Management”, and is derived from a designated link parameter. Only predefined categories are included in the statistics. We do not store full referrer or query URLs or freely entered source values there. The classification describes the individual request; it does not reconstruct previous visits.

The raw data for this separate count contains no IP addresses, browser identifiers, cookies or access keys. Known automated requests, preloading activity and requests marked with Do Not Track or Global Privacy Control are excluded from this count. Automated access cannot be detected in every case.

The reduced request data is deleted within seven days at the latest and aggregated into daily totals beforehand. For these statistics, we run Umami and our own aggregation on our netcup server in Nuremberg. The browser does not make requests to Umami servers, and the statistics are not transmitted to the software vendor. We retain daily totals for 90 days and aggregated monthly totals for no more than 24 months. Statistics backups are deleted after seven days.

We also count, on the server side, received contact, partner and EngageBeat Enterprise enquiries, setup registrations, bookings, completed setups, actual trial starts and the start of paid subscriptions. We can aggregate submitted registrations by the same predefined setup categories. This information comes from our own case processing and is passed to the statistics only as daily counts, without contact, customer or team identifiers. Responses and comments from employee surveys are not part of this analysis. Website visits are not linked to individual registrations, bookings or people. An invoice being issued or charging beginning does not count as confirmed receipt of payment.

Statistical analysis helps us evaluate and improve our offering. Where personal data is processed to generate the counts, we rely on Article 6(1)(f) GDPR and our legitimate interest in audience and conversion measurement that minimises data use. We explain your right to object under “Your rights”. Separate operational security logs and retention obligations for business transactions remain unaffected.

5. Cookies, analytics and fonts

The sales website does not use tracking or advertising cookies, Local Storage or Session Storage in its application code. No analytics scripts, advertising services or recognition identifiers are used in the browser. We use system fonts already available on your device for display. Font files are not loaded from Google Fonts or any other font provider.

The exception under section 25(2) TDDDG applies to storage on or access to your device that is strictly necessary. If services requiring consent were used beyond this, prior consent would be required. No such services are integrated into the sales website.

6. Recipients and retention

Enquiries are accessible to the people responsible for handling them and to the hosting and communication service providers we use, to the extent necessary for their tasks. Information may also be disclosed if we are legally required to do so or if it is necessary to establish or defend legal claims.

We delete contact enquiries that do not lead to a business relationship within 90 days after the matter is concluded. The operator cleans up the mailbox. If a business relationship develops, we retain the correspondence required for it for its duration. Statutory retention obligations and specific measures required to pursue legal claims remain reserved. Retention periods for documents subject to retention obligations depend on their respective legal classification. Unsubmitted form entries and the check-in demo are discarded as described in section 3. Submitted enquiries are subject to the processing and retention purposes stated above. Copies in the enquiry service are deleted after 30 days. However, binding bookings and setup registrations are removed there only after confirmed transfer to the customer management system, so that the case is not lost if a transfer fails; further processing takes place in the protected management system and mailbox. In the management system, completed enquiries that do not lead to a business relationship are removed after 90 days. Where a business relationship exists, its purposes and the separate retention periods for contract records apply. Details about personal setup access and contract records are provided in the app’s privacy notices.

7. Your rights

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent you have given at any time with effect for the future. Processing carried out before withdrawal remains unaffected.

Right to object: You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. You may object to direct marketing at any time.

To exercise your rights, contact hello@engagebeat.de. You may also lodge a complaint with a data protection supervisory authority, particularly in your place of residence, workplace or the place of the suspected infringement. At our company’s registered location, the competent authority is the State Commissioner for Data Protection of Saxony-Anhalt .

8. Automated decisions

We do not use this sales website to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. No corresponding profiling takes place.