PRIVACY

Privacy policy

This is an English translation. The German version is legally binding: Datenschutzerklärung.

1. General information

Controller

Curavani GmbH
Jülicher Str. 72a
52070 Aachen
Germany

Email: info@withgemba.com
Phone: +49 151 46359691

External data protection officer

IITR Datenschutz GmbH
Dr. Sebastian Kraska
Marienplatz 2
80331 München

Email: email@iitr.de
Phone: 089-18917360

2. How data is processed in general

Personal data is only collected when you give it to us yourself or when it is technically necessary. Beyond that, no personal data is collected. Any processing that goes further than the legal grounds allow only happens with your explicit consent.

3. Usage data on the website

When you open our pages, your browser has to send data to our web server. The following is recorded while your browser and our server are connected:

date and time of the request
name of the requested file
page from which the file was requested
access status (file transferred, file not found, and so on)
browser and operating system used
full IP address of the requesting computer
amount of data transferred

Infomaniak stores this data with the full IP address for at least 7 days, for security and troubleshooting. We do not use it for statistics and do not pass it on.

4. Specific to this website

Hosting

Our website is hosted by Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland. Infomaniak runs its data centres in Switzerland. The EU Commission has issued an adequacy decision for Switzerland (Art. 45 GDPR). The contact form log is stored there too.

Fonts

The fonts on this website are served from our own server. Opening a page makes no connection to Google Fonts or any other font provider.

Contact form

When you write to us through the form, your message goes to our server at Infomaniak. From there we send it as an email through the delivery service Postmark (ActiveCampaign, LLC, USA) to our mailbox at Google Workspace (Google Ireland Limited, Ireland). We also keep a log entry of every request on our web space, so we can check that a message arrived.

Data concerned: name, company (optional), email address, phone number and message; also the page language, the referring page, the browser identifier (user agent) and the time of the request
Purpose: handling and answering your request
Legal basis: Art. 6 (1) (b) GDPR (steps before a contract) and Art. 6 (1) (f) GDPR (legitimate interest in answering requests)
Recipients: Infomaniak Network SA (hosting), ActiveCampaign, LLC (email delivery through Postmark), Google Ireland Limited (mailbox)
Third-country transfers: Postmark processes the email in the USA. Postmark is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). EU standard contractual clauses apply in addition (Art. 46 GDPR). Google may transfer data to the USA; the basis is the EU-U.S. Data Privacy Framework.
Retention: We delete requests that do not lead to an order after 12 months. If a request leads to an order, we keep it as business correspondence for 6 years (Section 257 German Commercial Code).

Contact by email or phone

If you contact us by email or phone, we process your details to answer your request. The legal basis is Art. 6 (1) (b) and (f) GDPR. Our mailbox runs on Google Workspace.

Booking a call

The “Book a call” link (withgemba.com/call) leads to a Google Calendar appointment page operated by Google Ireland Limited. If you book a slot there, Google processes what you enter under its own privacy policy.

Data concerned: name, email address and what you enter in the booking form
Purpose: arranging and holding the call
Legal basis: Art. 6 (1) (b) and (f) GDPR
Recipients: Google Ireland Limited
Third-country transfers: possible, based on EU standard contractual clauses
Retention: until the request is settled, then as a calendar entry

Web analytics with PostHog (cookieless)

We use PostHog for web analytics, on PostHog Cloud EU. The provider is PostHog, Inc. (USA). The data is stored and processed on servers in Frankfurt am Main.

Cookieless setup: We set PostHog up so that it sets no cookies and stores no identifiers in your browser. The identifier of a page view lives only in memory and is gone when you leave the page. So we do not recognise you across page views or visits. We build no user profiles and record no sessions.

Data collected:

the page viewed and the referring page
browser, operating system, device type and screen size
approximate location (country, region, city), derived from the IP address
date and time
clicks on links and buttons, for example “Request a workshop”
that the contact form was sent, without its content

Legal basis: legitimate interest in statistical analysis to improve our website (Art. 6 (1) (f) GDPR)

Retention: analytics data is kept for 12 months.

Objection: Open withgemba.com/en/?notrack. Your browser then stores an opt-out note (in local storage), and PostHog records nothing more in this browser. Open withgemba.com/en/?track to undo it.

5. Your rights as a data subject

You have the following rights:

Right of access to the data stored (Art. 15 GDPR)
Right to rectification of incorrect data (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing (Art. 21 GDPR)
Right to withdraw consent (Art. 7 GDPR)

To use your rights, write to us at any time at info@withgemba.com or by post.

You also have the right to complain to the competent data protection supervisory authority. The one responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2-4
40213 Düsseldorf
www.ldi.nrw.de

6. Changes to this policy

This privacy policy is dated September 2026. As our website and our offering change, or as legal requirements change, it may need to be updated. The current version is always available on this website.