Privacy

Which data we process when you visit our website, and which rights you have.

1. Controller and data protection officer

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

cynapsis media GmbH
Neubrückenstraße 8–11
48143 Münster, Germany
Phone +49 251 48265-400
Email hello [at] cynapsis-media.de

You can find further details in the Legal notice.

You can reach our data protection officer at:

bits + bytes it-solutions GmbH & Co. KG
Krombacher Straße 24
57223 Kreuztal, Germany
www.bits-bytes.de (opens in a new tab)

2. Overview

Personal data is any information relating to an identified or identifiable person. We only process it to the extent necessary to operate this website, to answer your enquiries or, with your consent, for statistics.

  • Automatically when you visit: technical data transmitted by your browser, for example IP address, browser, operating system and time of access.
  • When you contact us: the details you give us by email, phone or via the contact form.
  • Only with your consent: usage statistics with Microsoft Clarity, Google Analytics and Umami recordings.

We do not sell data and do not use it for automated decision-making or profiling within the meaning of Art. 22 GDPR.

3. Your rights

You have the following rights regarding your personal data at any time:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Withdrawal of consent with effect for the future (Art. 7(3) GDPR), on this website at any time via the  

Right to object (Art. 21 GDPR): If we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds.

For all requests, a message to hello [at] cynapsis-media.de is enough. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de (opens in a new tab).

4. Hosting, server log files and encryption

This website runs on a web server of dream-soft GmbH, Buchenweg 73, 48268 Greven, Germany (server-provider.com). The server is located in Germany. We have concluded a data processing agreement with the provider (Art. 28 GDPR).

Each time the site is accessed, the server automatically stores so-called server log files: IP address, date and time, page accessed, amount of data transferred, the previously visited page (referrer) as well as browser and operating system. This is technically necessary to deliver the website and ensure its security, for example to fend off attacks. The legal basis is Art. 6(1)(f) GDPR. The log files are deleted after 7 days unless they are needed to investigate a security incident.

The connection to our website is encrypted using TLS. You can recognise this by “https://” and the padlock symbol in your browser's address bar. Data you send to us therefore cannot be read by third parties.

5. Contacting us and the contact form

If you write to us by email, phone or via the contact form, we process your details to answer your enquiry. In the form, this is your name, your email address and your message, and optionally your company, phone number and whether you are writing for a brand, a retailer or an agency.

With the form, your browser also transmits which page of our website you came to the form from. If you have agreed to the “Statistics” category, we also receive the history of this visit: the entry page, the website you came from, campaign details from the link (so-called UTM parameters), the pages viewed, the situations you clicked in our examples and the time until the enquiry (see section 8). This helps us answer your enquiry more specifically. These details are only included in the email to us, not in your confirmation.

The form data is transmitted to our server in encrypted form and sent from there as an email to our inbox. You automatically receive a confirmation of receipt at the address you provided. This confirmation does not contain your message itself.

For sending, we use Amazon Simple Email Service (SES) from Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, as a processor (Art. 28 GDPR). Processing takes place in the data centre in Frankfurt am Main, Germany (AWS region eu-central-1), under the AWS Data Processing Addendum. Amazon.com, Inc. is certified under the EU-US Data Privacy Framework in case data reaches the USA in individual cases.

To protect against misuse, we limit how many messages can be sent from one IP address per hour. For this we only store an encrypted value of the IP address, which is deleted after two hours at the latest. An invisible field and a time check detect automated submissions; no further data is collected in the process.

The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or steps prior to entering into one, otherwise our legitimate interest in answering enquiries and in protection against misuse (Art. 6(1)(f) GDPR). We delete your enquiry once your matter has been dealt with, unless statutory retention obligations apply, for example under commercial and tax law.

6. Consent and cookie settings

We only load services that are not strictly necessary with your consent (Art. 6(1)(a) GDPR, Section 25(1) of the German Telecommunications Digital Services Data Protection Act, TDDDG). On your first visit, a banner asks you for it. You can reject all services, accept all or select them individually.

We store your choice in your browser's local storage (entry “cm_consent”) so that we don't ask you again on every page view. This is technically necessary (Section 25(2) no. 2 TDDDG). We ask again after 12 months. You can change your choice at any time: . If you withdraw consent, we delete the cookies of the services concerned.

We use Google's Consent Mode v2. Without your consent, Google Analytics is not loaded at all.

7. Audience measurement with Umami

To see how often our pages are visited, we use the open-source software Umami on a server we operate ourselves, hosted by dream-soft GmbH in Germany (see section 4). Umami sets no cookies and stores nothing on your device. It records the pages visited, the previously visited page and rough details about browser, operating system, device type and country. IP addresses are not stored; visits are only grouped using an encrypted value that changes regularly. The data is not passed on to third parties.

We also count which controls are used, without reference to any person: clicks on situations and demos in our examples, on contact links, on links to other websites, changing the language, starting and successfully sending the contact form, and your choice in the cookie banner (whether you accept or decline). What you type into the form is not recorded.

The legal basis is our legitimate interest in data-minimal statistics about the use of our website (Art. 6(1)(f) GDPR). If your browser sends the “Do Not Track” signal, no measurement takes place. You can also object at any time (see section 3).

8. Statistics with consent

We only load the following services if you have agreed to the “Statistics” category in the banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw your consent at any time.

Umami heatmaps and session recordings

For some visits, Umami records how the page is used: clicks, mouse movements and scrolling, for five minutes at most. This produces heatmaps and replays of individual visits that we use to improve how the website works. Input in form fields is masked. No cookies are set, and the data stays on our own server.

Visit history for enquiries

For the duration of your visit, we note in your browser’s session storage (entry “cm_journey”, deleted when you close the tab) the entry page, the website you came from, campaign details from the link, the pages viewed and the situations you clicked in our examples. This data only leaves your device if you write to us via the contact form. We then receive it together with your enquiry (see section 5). If you withdraw your consent, we delete the entry.

Microsoft Clarity

The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. With heatmaps and session recordings, Clarity shows us how visitors use our website, for example where they click and how far they scroll. Input in form fields is masked. Clarity sets the cookies “_clck” (stored for one year) and “_clsk” (one day). More information: Microsoft privacy statement (opens in a new tab).

Google Analytics 4

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics produces statistics on page views, time on site, origin and devices used. Google Analytics 4 does not store IP addresses. The cookies “_ga” and “_ga_7379Q8ZKS6” are set and stored for up to two years. We have concluded a data processing agreement with Google. In Google Analytics, event data is deleted automatically after 2 months and user data after 14 months. More information: Google privacy policy (opens in a new tab).

Transfers to the USA

Microsoft and Google may also transfer data to their parent companies in the USA. For the USA there is an adequacy decision by the EU Commission (EU-US Data Privacy Framework); Microsoft Corporation and Google LLC are certified under it.

Our fonts are hosted locally. No connection to servers of Google Fonts or other font providers is made when you visit the website.

For appointment bookings we link to the service Reclaim.ai, and also to our product sites seboo.de and programmatiq.com. Data is only transferred to the respective provider once you follow such a link. Their privacy policy applies there.

10. Storage period and recipients

We only store personal data for as long as is necessary for the respective purpose or required by statutory retention periods. Recipients are only the service providers named in this policy. Where necessary, we have concluded data processing agreements with them.

You are not obliged to provide us with personal data. Without the technical connection data, however, we cannot display the website to you.

Last updated: November 2026