Privacy policy

This privacy policy provides information pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation; “GDPR”) concerning the processing of personal data in connection with this website, enquiries and research participation, including the supplementation of participant records with information obtained from third parties. Personal data means any information relating to an identified or identifiable natural person.

Controller

The controller within the meaning of Art. 4 (7) GDPR is:

Controller

Julian Lang, sole proprietor
trading as The BusinessOS Company

Address

Helmolfstr. 8
76646 Bruchsal
Germany

Email

team@businessos.company

For all questions relating to data protection, please contact us using the details above.

Hosting and server log files

Our website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”), which processes personal data on our behalf as a processor (Art. 28 GDPR).

When you access our website, your browser automatically transmits the following data, which is processed to deliver the website:

• IP address
• date and time of access
• the page accessed and the referring URL
• browser type and version, operating system and language settings

This data is processed for the provision, stability and security of the website and for the detection and prevention of unauthorised access and misuse. Requests to the survey submission service are additionally recorded in Cloudflare Workers log files for fault diagnosis and resolution. These log files contain technical request metadata and diagnostic events. Application-generated diagnostic messages do not contain survey responses, names or email addresses. Cloudflare Workers log files are retained for a maximum of seven days. Processing undertaken by Cloudflare as an independent controller is subject to its Privacy Policy.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the secure and reliable operation of our website. We do not use this data to create user profiles or to analyse how visitors use the website.

Fonts are hosted with the website. Their delivery does not involve a connection to an external font provider.

Cookies

Following successful submission of the research survey, the website stores the following cookie on your device:

The cookie may be deleted at any time through the browser settings. Deletion of the cookie does not constitute withdrawal of consent to research participation or a request for erasure of research data. Such requests may be submitted to the controller using the contact details above.

Where you select a light or dark display of the website, the selection is stored in the local storage of your browser:

The storage of this entry is strictly necessary to provide the display setting expressly requested by the user (§ 25 (2) no. 2 TDDDG). Where no selection is made, the website follows the display setting of the operating system, and no information is stored on your device for this purpose.

We do not use cookies or comparable technologies for visitor analytics or advertising. The processing of device information for security purposes is set out in the section “Protection against misuse”.

Participation in our research

We conduct research into the administration of businesses in Europe. Participation is voluntary. In connection with the research survey, we process the following categories of personal data:

• contact data: your name and email address
• professional data: your role and the size of your company
• survey responses: the administrative tasks that take up the most time, and the software you currently use for them

The purposes of processing are the evaluation of survey responses and communication with participants concerning the research, including invitations to interviews. Where participation continues, processing also includes research correspondence and information provided in the course of that participation. Consent to research participation does not extend to newsletters or other promotional communications unrelated to the research.

The legal basis is your consent (Art. 6 (1) (a) GDPR). You may withdraw your consent at any time with effect for the future, for example by email to team@businessos.company. The withdrawal does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal (Art. 7 (3) GDPR).

Supplementary information obtained from third parties. We use Attio to supplement participant and company records automatically by reference to participants’ email addresses and associated domains. Subject to availability, supplementary personal data comprises names, job titles, employers, locations, profile photographs, biographical information, social media profile links and follower counts. Supplementary company data comprises names, websites, business descriptions, industries, locations, company size and financial estimates. The source of this information is Attio’s third-party data providers, whose datasets may include information obtained from publicly accessible websites and social media profiles. Further particulars of the data categories are set out in Attio’s enrichment documentation.

The purpose of this processing is to associate responses with the relevant company and place them in their professional context. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the contextual evaluation of research responses. The rights to rectification and objection apply to supplementary information as set out below.

Research contact details and survey responses are stored in Attio. Related correspondence and working documents are processed in Google Workspace. Personal research data, including supplementary information and research correspondence, is erased when it is no longer required for the research purpose, upon withdrawal of consent, or at the latest 24 months after the participant’s most recent survey submission, subject to the retention grounds specified in the section “Storage period”. Irreversibly anonymised research results may be retained without limitation in time.

The provision of personal data is neither a statutory nor a contractual requirement. Submission of the survey requires a name, email address, role, company size, selection of at least one administrative task and consent to research participation. Information concerning software use is optional. Failure to provide the required information prevents submission of the survey but does not restrict access to the website.

Protection against misuse

We use Cloudflare Turnstile to protect the research survey against automated submissions and misuse. The service is activated upon access to the final contact step, prior to submission and independently of consent to research participation. For this purpose, Cloudflare processes the IP address, browser and connection characteristics, including TLS fingerprints and user-agent information, and the website origin. The verification token and IP address are transmitted to Cloudflare for validation. Transfer of survey data to Attio is conditional upon successful verification. Where verification is unsuccessful, the survey cannot be submitted. Enquiries may alternatively be addressed to us by email.

The legal basis for our processing is Art. 6 (1) (f) GDPR. Our legitimate interest lies in preventing spam and ensuring the security of the survey submission service. Access to information on the user’s terminal equipment is based on § 25 (2) no. 2 TDDDG insofar as such access is strictly necessary for the provision of that security function.

Cloudflare acts as a processor in providing the security service on our behalf. For the improvement of its bot detection capabilities, Cloudflare additionally processes Turnstile signals as an independent controller on the basis of its own legitimate interests. The particulars of that processing and the exercise of data subject rights are set out in the Turnstile Privacy Notice and Cloudflare Privacy Policy.

Contact by email

In connection with email enquiries, we process the sender’s contact details, message content, attachments and associated communication metadata for the purpose of handling the enquiry.

The legal basis is Art. 6 (1) (b) GDPR where processing is necessary for the performance of a contract with the data subject or to take steps at the data subject’s request prior to entering into a contract. In other cases, including enquiries made on behalf of an employer, processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in handling business correspondence and responding to enquiries. Research correspondence is processed on the basis of the consent specified in the section “Participation in our research”. Enquiry data is erased upon completion of the matter and any necessary follow-up, subject to the retention grounds specified in the section “Storage period”.

Email and productivity suite

We use Google Workspace, provided by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, for email communication, appointment scheduling and the creation, storage and management of documents. The personal data processed comprises contact details, email content and attachments, appointment information and personal data contained in working documents. Processing is undertaken for the purposes and on the legal bases applicable to the respective enquiry, research activity or contractual relationship, as specified in this policy.

The Europe (EU) data region is selected for Google Workspace. The regional restriction applies to the data and services covered by the applicable subscription and data-region configuration. Data outside that scope, including logs and cached content, and processing in connection with support services may be processed outside the EU. The scope of the regional restriction is specified in Google’s data-region documentation. International transfers are subject to the safeguards specified below.

Recipients

We disclose personal data to third parties only where this is permitted by law. We use the following processors, which process personal data on our behalf and in accordance with our instructions under a data processing agreement pursuant to Art. 28 GDPR:

The processors may engage subprocessors in accordance with the applicable data processing agreements. Cloudflare additionally acts as an independent controller for the Turnstile processing specified above. Other recipients may include professional advisers and public authorities insofar as disclosure is necessary for compliance with legal obligations or the establishment, exercise or defence of legal claims. Personal data is neither sold nor disclosed for advertising purposes.

Transfers to third countries

The use of the service providers specified above may involve transfers of personal data to countries outside the European Economic Area (EEA), including transfers to their subprocessors. The applicable transfer mechanisms are as follows:

• Cloudflare, Inc. (USA): Cloudflare is certified under the EU-U.S. Data Privacy Framework. The transfer is based on the adequacy decision of the European Commission of 10 July 2023 (Art. 45 GDPR). In addition, our data processing agreement with Cloudflare includes the European Commission’s standard contractual clauses (Art. 46 (2) (c) GDPR).
• Attio Ltd (United Kingdom): Transfers to the United Kingdom are based on the European Commission’s adequacy decision pursuant to Art. 45 GDPR, as renewed in December 2025. Onward transfers are subject to the safeguards provided in Attio’s Data Processing Addendum, including standard contractual clauses where applicable.
• Google Workspace: Processing by Google and its subprocessors outside the EEA is subject to the applicable regional commitments and transfer provisions of Google’s Cloud Data Processing Addendum. Transfers are based on applicable adequacy decisions or, for transfers not covered by such decisions, the standard contractual clauses specified in that agreement.

Where a transfer is not covered by an adequacy decision, the safeguards include the European Commission’s standard contractual clauses pursuant to Art. 46 (2) (c) GDPR, supplemented by additional measures where necessary. Information concerning the safeguards applicable to personal data, including a copy of those safeguards, may be obtained from the controller using the contact details above, subject to redactions necessary to protect confidential information and the rights of third parties.

Storage period

Unless a specific retention period is stated in this policy, personal data is retained for the period necessary to complete the relevant enquiry or processing purpose. Thereafter, the data is erased unless continued retention is required to fulfil a statutory obligation, in particular under commercial or tax law (Art. 6 (1) (c) GDPR), or is necessary for the establishment, exercise or defence of legal claims (Art. 6 (1) (f) GDPR). In the latter case, our legitimate interest lies in the protection and enforcement of our legal rights. Retention is limited to the records required for the respective purpose and continues until expiry of the applicable retention or limitation period or final resolution of the relevant proceedings. Processing during that period is restricted to the purpose justifying retention. Withdrawal of consent does not affect retention required on an independent legal basis.

Your rights

Subject to the applicable statutory conditions, you have the following rights:

• the right of access (Art. 15 GDPR)
• the right to rectification (Art. 16 GDPR)
• the right to erasure (Art. 17 GDPR)
• the right to restriction of processing (Art. 18 GDPR)
• the right to receive data you provided in a structured, commonly used, machine-readable format, and to have it transmitted where technically feasible, when processing is automated and based on consent or contract (Art. 20 GDPR)
• the right to withdraw your consent at any time with effect for the future (Art. 7 (3) GDPR)

Rights may be exercised by contacting team@businessos.company. Requests are handled free of charge, subject to the exceptions in Art. 12 (5) GDPR. Information on the action taken will be provided without undue delay and within one month of receipt. That period may be extended by up to two further months where necessary, taking into account the complexity and number of requests. Notice of any extension and the reasons for it will be provided within the initial one-month period (Art. 12 (3) GDPR). Where reasonable doubts exist concerning the identity of the applicant, we may request additional information necessary to confirm that identity (Art. 12 (6) GDPR).

Right to object

Where we process your personal data on the basis of our legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object to this processing at any time, on grounds relating to your particular situation (Art. 21 (1) GDPR). We will then no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The supervisory authority responsible for us is:

Authority

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg

Address

Heilbronner Straße 35
70191 Stuttgart
Germany

Website

Contact the supervisory authority

Automated decision-making

No decisions producing legal effects concerning a data subject or similarly significantly affecting a data subject are made solely on the basis of automated processing, including profiling, within the meaning of Art. 22 GDPR.

Data security

This website uses TLS encryption for the transmission of data. We take appropriate technical and organisational measures in accordance with Art. 32 GDPR to protect personal data against loss, misuse and unauthorised access. Access to survey responses is restricted to the persons involved in our research.

Changes to this privacy policy

We may update this privacy policy to reflect changes in legal requirements or in our processing activities. The current version is always available on this page. The date of the last update is shown at the top.