Privacy Policy

ThinkForm processes personal data responsibly and transparently. This Privacy Policy explains which personal data we process through our website thinkform.studio and related interactions.

The main purposes include improving the user experience, handling inquiries, developing our services, and operational tasks such as billing and account management.

We currently have not appointed a data protection officer. For privacy-related questions, please contact hello@thinkform.studio.

This Privacy Policy applies to visitors of the website, contacts, prospects, clients and customers of ThinkForm.

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

ThinkForm LLC
Email: hello@thinkform.studio

For any questions regarding this Privacy Policy or the processing of your personal data, please contact us using the email address above.

Personal data is processed on the basis of applicable legal provisions, in particular the GDPR. Depending on the processing activity, we rely on consent, contract performance, legal obligations or legitimate interests.

We may process categories of personal data such as names, email addresses, phone numbers, addresses, IP addresses, browser information, language settings, operating system information and payment information.

Processing may take place to provide our services, communicate with you, process payments, improve the website, analyze usage and comply with legal obligations.

When accessing our website, technically required access data may be processed, including IP address, access time, requested pages, browser type, operating system and referrer URL. This data is used for technical delivery, security and error analysis.

Our website and related services are hosted on infrastructure located in Germany and the European Union.

When you access our website, technical access data such as your IP address, browser information, requested pages, access time and referrer URL may be processed to deliver the website, ensure security, prevent misuse and maintain technical operation.

Where service providers process personal data on our behalf, they do so under appropriate contractual arrangements in accordance with applicable data protection laws.

Personal data is processed only to the extent necessary to provide, secure and operate our website and related services.

We use Cloudflare services to improve the security and performance of our website and to protect forms against spam, abuse and automated requests.

In this context, technical data such as IP addresses, request metadata, browser information and security-related signals may be processed.

Cloudflare Turnstile may be used when submitting forms to determine whether the request originates from a legitimate user.

The processing is based on our legitimate interest pursuant to Art. 6 (1) lit. f GDPR in securing our website, preventing misuse and ensuring reliable technical operation.

Personal data is stored only for as long as necessary for the respective purposes or as required by statutory retention obligations. We use technical and organizational measures to protect personal data against unauthorized access, loss, alteration or disclosure.

We share personal data only where necessary to provide our services, where legally required, where consent has been given or where a legitimate interest exists. Service providers are engaged on the basis of data processing agreements where required.

Within the legal requirements, you have rights of access, rectification, erasure, restriction of processing, data portability, objection and complaint to a supervisory authority.

To exercise your rights, please contact hello@thinkform.studio.

You may withdraw consent at any time with effect for the future. The lawfulness of processing before withdrawal remains unaffected.

We use cookies and similar technologies to technically provide the website, enable functions, analyze usage and support marketing measures. Non-essential cookies are only set with your consent.

When first visiting the website, you may use a cookie banner to decide which categories of cookies and technologies you want to allow. You can change or withdraw your selection at any time.

Certain settings may be stored locally in your browser (local storage), for example your cookie preferences under the key thinkform_cookie_consent_v1 and your theme preference (light/dark mode) under the key payload-theme. This storage is used to technically apply your selection.

The specific cookie list may change as services change.

You can reopen your cookie settings at any time, change your selection or withdraw previously given consent with effect for the future.

Edit cookie consent

We use a self-hosted installation of Umami to better understand how visitors use our website and to improve usability and performance.

Depending on the configuration, usage data such as visited pages, referrer information, browser type, device type, operating system and approximate location may be processed.

We do not use this information to create advertising profiles.

Where required by law, analytics are only enabled after obtaining your consent. Otherwise, processing is based on our legitimate interest pursuant to Art. 6 (1) lit. f GDPR in improving our website.

If you contact us through our contact form, we process the information you provide, including your name, email address, message and any additional information submitted through the form.

The processing is carried out solely for the purpose of responding to your inquiry and communicating with you.

The legal basis is Art. 6 (1) lit. b GDPR where your request relates to pre-contractual measures or a contract, and otherwise Art. 6 (1) lit. f GDPR based on our legitimate interest in responding to inquiries.

We use a self-hosted instance of Cal.diy to allow you to book appointments with us.

When you schedule an appointment, we may process:

• Name
• Email address
• Selected appointment date and time
• Time zone
• Any additional information voluntarily provided in the booking form

This information is processed solely to organize, prepare and conduct the requested appointment.

Our scheduling system is operated on infrastructure under our control. Your booking data is not processed by Cal.com or any third-party scheduling provider.

Once an appointment has been confirmed, appointment information may be synchronized with Google Calendar for scheduling purposes.

Processing is based on Art. 6 (1) lit. b GDPR and, where applicable, Art. 6 (1) lit. a GDPR for optional information.

Appointment data is retained only as long as necessary.

We may use Google Meet for online appointments. In this context, names, email addresses, meeting metadata and technical connection data may be processed.

We may use Zoom for online meetings. Meeting metadata, name, email address, technical connection data and audio/video data may be processed if you participate in a meeting.

You may subscribe to our newsletter to receive updates about new articles, insights, projects, offers, available capacity and news from ThinkForm approximately once per month.

For newsletter subscription and delivery, we process in particular your email address and, where applicable, your name. The processing is based on your consent pursuant to Art. 6(1)(a) GDPR.

Depending on the technical configuration, we may use a double opt-in procedure to confirm your subscription. In this case, the time of registration, the time of confirmation and the IP address may be processed to document your consent.

You may unsubscribe from the newsletter at any time using the unsubscribe link in the newsletter or by contacting hello@thinkform.studio. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

The newsletter is managed using a self-hosted installation of Listmonk operated on infrastructure under our control. The data is stored only for as long as your newsletter subscription remains active or as otherwise required by statutory retention obligations.

We may use Zoho Mail for business email communication. Email content, sender and recipient data as well as technical communication data may be processed.

We use a self-hosted installation of the CRM software Odoo to manage customer and prospect relationships and to organize our communication with you.

This may include your name, contact details (e.g. email address, phone number), company information, and information relating to our communication and collaboration.

Odoo is operated on infrastructure under our control. Your data is not transmitted to the Odoo provider.

Processing is based on Art. 6(1)(b) GDPR where it serves the initiation or performance of a contract, and on Art. 6(1)(f) GDPR based on our legitimate interest in the structured management of our business relationships.

Your data is retained only for as long as necessary for the purposes of the business relationship or as required by statutory retention obligations.

We provide a Telegram bot that allows you to communicate with ThinkForm and use selected services and information.

Controller

The controller responsible for processing personal data in connection with the Telegram bot is the entity named in our Legal Notice (Imprint).

Data We Process

When you use our Telegram bot, we may process the following information:

• Your Telegram User ID
• Your Telegram username (if available)
• Your display name
• The content of messages you send to the bot
• Date and time of your communication
• Technical metadata transmitted by Telegram as part of the bot interaction

This information is processed solely as part of your interaction with the bot.

Purpose of Processing

We process your data to:

• provide and operate the Telegram bot,
• respond to your requests,
• improve our services,
• diagnose technical issues, and
• ensure the security and stability of the service.

Legal Basis

Processing is carried out in accordance with Article 6(1)(b) GDPR where necessary to respond to your request or provide the requested service, and Article 6(1)(f) GDPR based on our legitimate interest in providing a secure and efficient communication channel.

Recipients of Data

Depending on the functionality of the bot, your messages may be processed by technical service providers (such as hosting, automation, or AI services) where this is necessary to provide the service.

Data Retention

We retain communication data only for as long as necessary to process your request, troubleshoot technical issues, or comply with applicable legal obligations.

Telegram

The bot is provided through the Telegram Messenger platform. Telegram processes personal data under its own responsibility. Therefore, Telegram's Privacy Policy also applies: https://telegram.org/privacy-tpa

For more information about Telegram's processing of personal data, please refer to their Privacy Policy.

We use Stripe to process payments and manage payment-related events.

When making a payment, billing information, payment details, transaction information and technical communication data are processed by Stripe.

Stripe uses secure webhooks to synchronize payment events between Stripe and our systems.

These may include payment status, invoice status or transaction references.

Processing is carried out pursuant to Art. 6 (1) lit. b GDPR.

Further information is available in Stripe's own Privacy Policy.

We may use PayPal for payment processing. If you choose PayPal as a payment method, payment and transaction data is transmitted to PayPal. PayPal’s own privacy information also applies to PayPal’s processing.

We may embed YouTube videos. When embedded videos are loaded or played, data may be transferred to Google or YouTube. Where possible, we use privacy-friendly embed variants or load content only after your interaction or consent.

We may optionally use the LinkedIn Insight Tag for conversion tracking, retargeting and campaign measurement. The Insight Tag is only loaded if you have consented to the marketing category.

The legal basis is your consent under Art. 6(1)(a) GDPR.

We use the service Apollo (Apollo.io / Apollo Technologies, Inc., San Francisco, USA) to identify which companies, and in some cases which individuals, visit our website, and to enrich prospect and customer data in our CRM.

For this purpose, our website includes a JavaScript tracking script (pixel) that sets a cookie in the visitor's browser and collects technical data such as IP address, pages visited, time on site and click paths.

This data is matched against Apollo's database to determine which company the visit originates from ("company-level identification"). For visits from the United States, Apollo may additionally attempt to identify individual visitors based on their IP address and associate their name, job title and publicly available contact details ("contact-level identification").

We use the information obtained in this way to prioritize prospects, process sales inquiries and personalize our outreach. This involves a transfer of personal data to Apollo in the USA; Apollo has contractually committed to appropriate safeguards for this transfer, including EU Standard Contractual Clauses.

The tracking script is only loaded if you have consented to the marketing cookie category. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

Further information about Apollo's processing of personal data is available in Apollo's Privacy Policy: https://www.apollo.io/privacy-policy.

We may update this Privacy Policy if our data processing activities, services used or legal requirements change. The current version is available on our website.