Privacy Policy

1. Controller & Contact

The controller pursuant to Art. 4(7) GDPR is Build.One GmbH, Friedrichstr. 15, 70174 Stuttgart, Germany. Tel.: +49 711 9253920, E-Mail: info@build.one. For privacy enquiries contact datenschutz@build.one.

2. Scope of Processing

This policy covers the build.one website, marketing communications, customer enquiries, webinars, events, and recruiting. We process identification data (name, contact details, company), usage and device data, contract data, and application data as required for providing services, responding to enquiries, delivering webinars, measuring reach, and managing recruiting workflows.

Legal bases: Art. 6(1)(b) GDPR (performance of contract), Art. 6(1)(f) GDPR (legitimate interests such as secure operations and product improvement), and Art. 6(1)(c) GDPR (statutory obligations). Should consent-based processing become necessary in the future (e.g., newsletter subscriptions), Art. 6(1)(a) GDPR will apply and will be documented here before activation.

3. Cookies & Tracking

This marketing site intentionally ships with no cookies, pixels, fingerprinting scripts, or consent banners. Pages are static and only load the assets required to render the UI. All fonts are self-hosted—no requests are made to external font services. If essential cookies become necessary—such as for secure demos—we will disclose them in advance and keep them disabled until you opt in.

The site does not load assets from third-party CDNs. Should future features require external resources, they will be documented here before activation.

To understand how many people reach this site and which pages are useful, we use Vercel Web Analytics. It measures aggregate reach only: page views, the referring source, an approximate country, and coarse device or browser type. It sets no cookies and writes nothing to your device’s storage. Visitors are counted using a non-reversible hash derived from the incoming request, which is re-salted daily and cannot be traced back to you or linked to a later visit. No cross-site or cross-session profile is built. Because nothing is stored on or read from your device, no consent banner is required under § 25 TTDSG; the processing itself relies on Art. 6(1)(f) GDPR (legitimate interest in measuring the reach and usefulness of our own content).

We additionally count three anonymous interaction events on the contact form: that the form was opened, that someone began filling it in, and that it was submitted successfully. Each event records only the path of the page it happened on. They carry no form content—no name, email address, company, or use-case description is ever passed to analytics. Details you enter into the form are processed solely to respond to your enquiry, as described above.

You can switch all of this off at any time by appending ?analytics=off to any page URL. Do Not Track and Global Privacy Control browser signals are honoured automatically, with no action required on your part.

The private investor-deck route at /investors/deck, which is shared by link and not linked from this site, is measured in more detail. Using the same cookie-free Vercel Web Analytics, it records whether the deck was opened, which slides were viewed, whether the final slide was reached, and whether the PDF or contact action was used. Outreach links may carry a neutral pseudonymous outreach code such as iv01. The analytics event contains that code, never a name or email address; the mapping is held offline by Build.One for fundraising follow-up, and the code is stripped from automatically measured page URLs. Processing relies on Art. 6(1)(f) GDPR (legitimate interest in evaluating investor materials). Append ?analytics=off to the deck URL to disable these events; Do Not Track and Global Privacy Control signals are honoured automatically.

4. Processors & International Transfers

This landing page is hosted and delivered by Vercel Inc. (USA). Vercel operates a global edge network that may serve pages from EU and non-EU locations. Data processing is governed by Vercel's Data Processing Addendum, which incorporates EU Standard Contractual Clauses. Vercel participates in the EU-U.S. Data Privacy Framework. Processing relies on Art. 6(1)(f) GDPR (legitimate interest in reliable, performant website delivery).

Vercel also processes the cookie-free website and investor-deck analytics described above on Build.One's behalf. Beyond that, the site embeds no HR, CRM, advertising, or marketing automation tools. Should future experiences (for example, gated demos or recruiting forms) require additional processors, they will be disclosed in product flows and documented here before activation.

Where partners operate outside the EU/EEA, Build.One relies on EU Standard Contractual Clauses, adequacy decisions (such as the EU-U.S. Data Privacy Framework), and case-by-case risk assessments pursuant to Art. 44 et seq. GDPR to ensure appropriate safeguards.

5. Storage & Deletion

Personal data is retained only as long as necessary for the respective purpose. Once contractual and statutory retention periods (e.g., in accordance with HGB or AO) expire, the data is deleted or anonymised. Applicant data is erased after conclusion of the recruitment process unless statutory retention or explicit consent requires a longer period.

6. Your Rights

• Access, rectification, erasure, restriction, and data portability (Art. 15–20 GDPR).
• Withdrawal of consent and objection to processing carried out under Art. 6(1)(e) or 6(1)(f) GDPR, including profiling.
• Right to lodge a complaint with a supervisory authority.

Please direct requests to datenschutz@build.one.

7. Third-Party Links

External websites accessible via build.one links operate under their own privacy policies. Review third-party notices before submitting personal information.