Last updated: July 2026

1. Overview and Controller
This privacy policy informs you in accordance with Art. 12 et seq. GDPR about the processing of personal data when using the website https://sensape.com including all subpages. It does not apply to linked websites of other providers.

Controller:
Sensape GmbH
Spinnereistraße 7, 04179 Leipzig, Germany
E-mail: hallo@sensape.com
Phone: +49 341 3929 8552

Data Protection Officer:
Spirit Legal LLP Rechtsanwälte
Attorney Peter Hense
Postal address: Data Protection Officer c/o Sensape GmbH, Spinnereistraße 7, 04179 Leipzig, Germany
Contact via encrypted online form: Contact Data Protection Officer

We reserve the right to amend this privacy policy with effect for the future, in particular in the event of further development of the website, the use of new technologies, or changes in the legal situation.

2. Your Rights
You have the following rights vis-à-vis us regarding your personal data:
• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before withdrawal remains unaffected

An informal message to the contact details above is sufficient to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Saxon Data Protection and Transparency Officer, Devrientstraße 5, 01067 Dresden, Germany, https://www.datenschutz.sachsen.de.

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing purposes at any time without stating reasons.

3. Hosting and Access Data (Server Log Files)
Our website is hosted by Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA; content is delivered via a content delivery network. When you access the website, the following access data is processed automatically:
• IP address
• Date and time of the request, time zone difference to GMT
• Page accessed / content of the request
• Access status / HTTP status code
• Volume of data transferred
• Referrer URL
• Browser type, version and language, operating system

This processing is technically necessary to display the website to you and to ensure its stability and security. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and efficient provision of the website. Log files are deleted as soon as they are no longer required for this purpose, unless a security-relevant event requires longer retention.

A data processing agreement pursuant to Art. 28 GDPR is in place with Webflow. Insofar as data is transferred to the USA, the transfer is based on the adequacy decision for the EU-U.S. Data Privacy Framework (DPF); Webflow is certified under the DPF. In addition, standard contractual clauses pursuant to Art. 46(2)(c) GDPR have been concluded.

4. Cookies and Consent Management
We use cookies and comparable technologies (e.g. pixels, local storage).

Technically necessary cookies (e.g. language setting, session ID, storage of your consent decision) are used on the basis of Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); the associated data processing is based on Art. 6(1)(f) GDPR (interest in a functioning website).

All non-essential cookies and technologies (statistics, marketing, external media – see Sections 8–12) are used exclusively with your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR. We obtain consent via our consent banner on your first visit. You can withdraw your consent or adjust your selection at any time with effect for the future via the “Cookie Settings” link in the website footer.

Without consent, the services concerned are not loaded.

5. Contacting Us
When you contact us by e-mail, phone, WhatsApp or via the contact form, we process the data you provide (name/pseudonym, e-mail address, phone number, message content) and, for the form, additionally your IP address and time of submission (to prevent misuse and ensure system security) exclusively to handle your enquiry.

The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to the conclusion or performance of a contract, otherwise Art. 6(1)(f) GDPR (interest in responding to enquiries). We delete the data once the enquiry has been fully processed, provided no statutory retention obligations (Section 147 AO, Section 257 HGB) apply.

WhatsApp: If you contact us via WhatsApp, WhatsApp Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland, processes communication metadata in accordance with its own privacy policy. Transfers to the USA are covered by the EU-U.S. DPF (Meta Platforms, Inc. is certified). Please use e-mail or the contact form for confidential matters.

6. Processing for Contractual Purposes
We process personal data insofar as this is necessary for the initiation, conclusion, performance or termination of a contract (Art. 6(1)(b) GDPR). Data is only disclosed to third parties where:
• necessary for contract performance (e.g. payment service providers, logistics) – Art. 6(1)(b) GDPR,
• we use processors pursuant to Art. 28 GDPR,
• a legal obligation exists (Art. 6(1)(c) GDPR), or
• you have consented (Art. 6(1)(a) GDPR).

Once the purpose has been fulfilled, data is deleted or restricted from further processing, subject to statutory retention periods (generally 6 or 10 years under HGB/AO).

7. Newsletter
We use Mailjet, a service of Sinch Email SAS, 4 Rue Jules Lefebvre, 75009 Paris, France, as a processor (Art. 28 GDPR) to send our newsletter.

Registration follows a double opt-in procedure: after entering your e-mail address, you receive a confirmation e-mail; the newsletter is only activated upon confirmation. We log registration and confirmation (time, IP address) to be able to prove consent (Art. 5(2), Art. 7(1) GDPR).

The legal basis for sending the newsletter and the associated performance measurement (open and click rates) is your consent, Art. 6(1)(a) GDPR. You can unsubscribe at any time via the link in every e-mail or by contacting us. After unsubscribing, we store your e-mail address solely to document the former consent or on a suppression list (Art. 6(1)(f) or (c) GDPR).

8. Web Analytics: Google Analytics
Only with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG) do we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Analytics 4 uses cookies and similar technologies to analyse website usage. IP addresses are not stored by Google Analytics 4 by default; they are only used for a rough location derivation and then discarded. The data collected (e.g. pages visited, dwell time, approximate location, device data) is processed on our behalf to compile reports on website usage and to improve our offering.

Transfers to Google LLC servers in the USA are possible. Google LLC is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses (Art. 46(2)(c) GDPR) have additionally been concluded. A data processing agreement pursuant to Art. 28 GDPR is in place with Google. Our retention period for user and event data is 14 months.

Withdrawal: at any time via the Cookie Settings in the footer. Further information: Google Privacy Policy

9. Online Marketing: Google Ads, Google Remarketing
Only with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG) do we use Google Ads with conversion tracking and remarketing provided by Google Ireland Limited.

Conversion tracking: If you click on an ad placed by Google, a cookie is set (validity usually 30–90 days). If you subsequently visit certain pages of our website, Google and we can evaluate that the ad led to the visit. The data is used to compile conversion statistics.

Remarketing: Based on your usage behaviour on our website, interest-based ads may be displayed to you on other websites within the Google advertising network.

We use Google Consent Mode v2: without your consent, no marketing cookies are set and no personal data is transmitted to Google.

Transfers to the USA are covered by the EU-U.S. DPF (Google LLC certification) and standard contractual clauses. Withdrawal at any time via the Cookie Settings. Further information: Google Advertising Technologies

10. Meta Pixel (Facebook)
Only with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG) do we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.

The pixel enables us to target visitors of our website as an audience for ads on Facebook/Instagram (Custom Audiences) and to measure ad effectiveness (conversion tracking). Among other things, your IP address, device information and usage behaviour on our website are transmitted to Meta; if you are logged in to Meta, Meta can attribute the data to your account.

For the collection and transmission of data via the pixel, we and Meta are joint controllers pursuant to Art. 26 GDPR; the corresponding agreement is available here: Meta Joint Controller Addendum. Subsequent processing by Meta takes place under its sole responsibility.

Transfers to the USA are covered by the EU-U.S. DPF (Meta Platforms, Inc. certification). Withdrawal at any time via the Cookie Settings; ad preferences at Meta: Meta Ad Preferences. Further information: Meta Privacy Policy

11. LinkedIn Insight Tag
Only with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG) do we use the Insight Tag provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, for conversion tracking and retargeting within the LinkedIn network.

Data processed includes URL, referrer URL, IP address (truncated or hashed), device and browser characteristics, and timestamps. Direct identifiers are removed by LinkedIn within seven days; the pseudonymised data is deleted within 180 days.

Transfers to the USA are covered by the EU-U.S. DPF (LinkedIn Corporation certification). Withdrawal at any time via the Cookie Settings; LinkedIn opt-out: LinkedIn Retargeting Opt-Out. Further information: LinkedIn Privacy Policy

12. Embedded Third-Party Content and Services

a) YouTube Videos
We embed videos via YouTube (Google Ireland Limited) in privacy-enhanced mode. No data is transmitted to YouTube when you merely visit the page. Only when you start a video or give consent via the consent banner (“External Media” category) (Art. 6(1)(a) GDPR, Section 25(1) TDDDG) does YouTube receive the information that you accessed the page, along with the access data listed in Section 3. If you are logged in to Google, usage may be attributed to your account. Transfers to the USA: EU-U.S. DPF and SCCs. Further information: Google Privacy Policy

b) Google Maps
We use Google Maps (Google Ireland Limited) to display maps. The map is only loaded after your consent via the consent banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). When loaded, your IP address and access data are transmitted to Google. Transfers to the USA: EU-U.S. DPF and SCCs. Terms of use: Google Maps Terms of Use

c) Google reCAPTCHA
To protect our forms against automated misuse and spam, we use Google reCAPTCHA (Google Ireland Limited). reCAPTCHA analyses the behaviour of the website visitor based on various characteristics (e.g. IP address, dwell time, mouse movements); the analysis runs in the background.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, Section 25(1) TDDDG, which we obtain via the consent banner before reCAPTCHA is loaded. Transfers to the USA: EU-U.S. DPF and SCCs. Further information: Google Privacy Policy and About Google reCAPTCHA

d) Google Fonts (locally hosted)
To display fonts consistently, we embed Google Fonts locally. No connection to Google servers is established and no data is transmitted to Google.

e) LiveChat
For chat enquiries we use LiveChat by LiveChat, Inc. (Text, Inc.), One International Place, Suite 1400, Boston, MA 02110, USA. The chat widget is only loaded after your consent via the consent banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). When you use the chat, we process your chat messages and your IP address; providing your name is voluntary. A data processing agreement is in place with LiveChat; transfers to the USA are safeguarded by standard contractual clauses pursuant to Art. 46 GDPR. Chat histories are deleted once the enquiry has been fully processed. Further information: LiveChat Privacy Policy

f) Google Tag Manager
We use Google Tag Manager (Google Ireland Limited) to manage website tags. The Tag Manager itself does not set cookies and does not collect personal data; it merely triggers other tags, which in turn are only loaded after the corresponding consent has been given.

13. Social Media Profiles
We maintain profiles on LinkedIn, Instagram and YouTube. When you visit these profiles, the privacy policies of the respective providers apply. Insofar as the providers make statistics about the use of our profiles available to us (e.g. LinkedIn Page Insights, Meta Insights), we are joint controllers with the respective provider pursuant to Art. 26 GDPR. The legal basis is Art. 6(1)(f) GDPR (interest in external communication and presentation). You can assert your data subject rights against both us and the respective provider.

14. Recipients, Storage Period, Security
Recipients: Within our company, only those units that need your data to perform their tasks have access to it. External recipients are the service providers named in this policy (mostly as processors pursuant to Art. 28 GDPR) and, where legally required, public authorities.

Storage period: Unless specified in the individual sections, we store personal data only for as long as necessary for the respective purpose or as required by statutory retention obligations.

Security: We implement technical and organisational measures pursuant to Art. 32 GDPR (including TLS encryption of the website, access restrictions, regular review of measures) to protect your data against unauthorised access, loss and misuse.

15. No Automated Decision-Making
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place on this website.

16. Obligation to Provide Data
You are neither legally nor contractually obliged to provide us with personal data. However, without certain information (e.g. contact details in the form), we may not be able to process enquiries or conclude contracts.