1. Controller

The controller responsible for data processing on this website within the meaning of the GDPR is:

Albaretos GmbH
Kaiserin-Augusta-Allee 87
10589 Berlin, Germany
Email: sales@albaretos.com
Phone: +420 602 219 204
Represented by: Petr Rektorys, Managing Director

2. Data Protection Officer

Based on its current size and the nature and scope of its data processing activities, Albaretos GmbH is not currently required to appoint a Data Protection Officer under Art. 37 GDPR / Sec. 38 of the German Federal Data Protection Act (BDSG). For any questions regarding data protection, please contact the controller directly using the details above.

3. Your rights at a glance

You have the right to obtain information about your stored data free of charge at any time, as well as the right to rectification, restriction of processing, erasure and data portability. If you believe that the processing of your data violates data protection law, or your data protection claims have otherwise been infringed, you may complain to a supervisory authority. Full detail on these rights is set out in Section 10 below.

4. Hosting and server log files

This website is provided by a hosting provider on whose servers it is stored (“hosting”). When you visit this website, the hosting provider automatically collects and stores information in so-called server log files, which your browser transmits automatically. This typically includes: your device's IP address, the date and time of access, browser type and version, operating system, the referring website (referrer URL), the pages or files requested, and the volume of data transferred.

This data is not merged with other data sources.

Purpose: ensuring the stable, secure and reliable operation of the website, and detecting and preventing misuse.
Legal basis: Art. 6(1)(f) GDPR – legitimate interest in the secure and reliable technical operation of the website.
Retention: server log files are typically deleted automatically after a short period, unless retention is required for the investigation of a specific security incident.

5. Contact form

This website provides a contact form for enquiries. The data you enter (subject, name, organisation, email address and message, together with the selected website language) is transmitted over an encrypted connection to our web server, processed there by a script operated by Albaretos GmbH and forwarded by email to sales@albaretos.com. The form data is not stored in a database on the web server. To prevent misuse, a salted, non-reversible hash of your IP address is kept on the web server to limit the number of submissions per connection; it is no longer used after one hour and is then deleted automatically. Your IP address itself is not stored for this purpose.

Purpose: responding to your enquiry, including project- and investor-related requests.
Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract), and, where no contract is pursued, Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries directed to us).
Retention: enquiries are kept in our email system for as long as necessary to process your enquiry and any resulting business relationship, and are then deleted unless statutory retention obligations require otherwise.

Spam protection (Cloudflare Turnstile): to protect the contact form against automated misuse, the contact page uses Cloudflare Turnstile, a service provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When the contact page is loaded, the Turnstile script is retrieved from Cloudflare's servers and evaluates technical information from your browser (such as IP address, browser and device characteristics) in order to distinguish human visitors from automated programs. When you submit the form, our server sends the resulting verification token together with your IP address to Cloudflare for checking. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protecting our website and mailbox against spam and abuse); access to information on your device is strictly necessary to provide the contact form you are using (Sec. 25(2) no. 2 TDDDG). On transfers to the USA, see Section 9. Further information: Cloudflare Turnstile privacy addendum.

6. Investor and document requests

Requests for the Investor Memorandum, Executive Summary, Financial Model, Governance Package or Data Room access referenced on the Investor Relations page are submitted via the same contact form and email address described in Section 5 above, and are processed on the same legal basis. No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.

7. Cookies and tracking

This website does not use cookies, web analytics services, tracking pixels, third-party font CDNs or social-media plug-ins. The only third-party script is Cloudflare Turnstile, which is loaded exclusively on the contact page to protect the contact form against spam (see Section 5). No personal data is transmitted to third parties for advertising or analytics purposes when you visit this website. Your selected language (EN/DE) is stored only locally in your browser (local storage) so the website remembers your choice on a future visit; this information never leaves your device.

8. Recipients of data / third parties

Personal data is only shared with technical service providers strictly necessary to host and operate this website (see Section 4) and, for spam protection of the contact form, with Cloudflare, Inc. (see Section 5). In the case of enquiries submitted under Sections 5 and 6, data is accessible only to the Albaretos GmbH personnel responsible for handling the relevant matter. Albaretos GmbH does not sell personal data or share it with third parties for their own marketing purposes.

9. International data transfers

When the contact page is used, data is transferred to Cloudflare, Inc. in the USA in connection with Cloudflare Turnstile (see Section 5). This transfer is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Cloudflare is certified. Apart from this, no transfer of personal data to countries outside the European Union or European Economic Area is currently intended in connection with this website, other than a potential transfer arising from the location of the hosting provider referenced in Section 4.

10. Data subject rights in detail

Subject to the applicable legal requirements, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) – to obtain confirmation as to whether data concerning you is processed, and access to that data.
• Right to rectification (Art. 16 GDPR) – to request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17 GDPR) – to request deletion of your data, subject to statutory exceptions.
• Right to restriction of processing (Art. 18 GDPR) – to request that processing of your data be restricted.
• Right to data portability (Art. 20 GDPR) – to receive data you have provided in a structured, commonly used, machine-readable format.
• Right to object (Art. 21 GDPR) – to object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR.

To exercise any of these rights, please contact the controller using the details set out in Section 1.

11. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement. The supervisory authority competent for Albaretos GmbH is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219
10969 Berlin, Germany

12. Data security

This website is intended to be operated exclusively over an encrypted connection (HTTPS/TLS) to protect data transmitted through it against unauthorised access by third parties.

13. Changes to this policy

This Privacy Policy may be updated from time to time to reflect changes to this website or to applicable legal requirements. The version published on this page is always the current version.