OPTIVANTAAgencyBack to home

Privacy policy

1. Controller

Optivanta Solutions LLC
3833 Powerline Rd, Suite 201
Fort Lauderdale, FL 33309, USA
Email: E.Dincdemir@OptivantaAgency.com

For any questions regarding data protection, or to exercise your rights, please contact us at E.Dincdemir@OptivantaAgency.com.

1a. Representative in the European Union

As Optivanta Solutions LLC has no establishment in the European Union, we have appointed the following representative pursuant to Art. 27 GDPR. In addition to contacting us directly, you and the supervisory authorities may contact our representative on all matters relating to the processing of personal data:

Prighter EU Rep GmbH
Schellinggasse 3/10
1010 Vienna
Austria

Contact the representative: app.prighter.com/portal/18359262017

In several places on our website (including the home page, the imprint and here), we embed a certificate of Art. 27 representation provided by Prighter as an image. When the respective page loads, this image is loaded from app.prighter.com, and your IP address is transmitted to Prighter. The legal basis is our legitimate interest in demonstrating our GDPR representation (Art. 6(1)(f) GDPR).

GDPR Certification: Art 27 representation by Prighter
powered by Prighter

2. Scope and applicable law

This privacy policy applies to all pages of this website in all language versions. Optivanta Solutions LLC is a limited liability company incorporated in Florida, USA, and as a U.S. company complies with U.S. law.

For visitors from the European Union and the EEA, the General Data Protection Regulation (GDPR) and, in Germany, the Telecommunications Digital Services Data Protection Act (TDDDG) also apply to the extent provided for in Art. 3 GDPR. The information required under these laws is set out in the following sections. Additional information for specific countries can be found in sections 11 to 13.

3. Hosting and content delivery (Cloudflare)

Our website is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, and delivered via the Cloudflare network, which also protects the website against attacks. When you visit the website, Cloudflare automatically processes technical data (server log files): IP address, date and time of access, page requested, referrer URL, browser type and operating system. This data is technically required to deliver and secure the website, is not combined with other data sources, and is deleted within a few days, and in any event no later than 30 days.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and functional website). A data processing agreement pursuant to Art. 28 GDPR, including the EU Standard Contractual Clauses, is in place with Cloudflare. Cloudflare is certified under the EU-U.S. Data Privacy Framework. Further information: cloudflare.com/privacypolicy

4. Cloudflare Web Analytics

We use Cloudflare Web Analytics to measure website reach. The service does not set cookies, does not store any information on your device and does not create user profiles. Only aggregated data is collected, such as pages viewed, load times, referrer, country, browser and device type. Your IP address is not used to identify you.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a data-minimising analysis and improvement of our website). You may object to this processing at any time (Art. 21 GDPR).

5. Forms and enquiries

Our website contains forms for strategy calls, the AI check, website enquiries, DACH market entry enquiries, the DACH playbook, the free marketing check, the EMMA pilot list, the free penetration quick test, as well as applications and sign-ups (freelancers, UGC creators, Academy waiting list). We process the information you provide, such as name, email address, company, website, country, industry and your message, solely to handle your request.

  • DACH playbook: we use your email address solely to send you the playbook, not for advertising or a newsletter.
  • Academy waiting list: on the basis of your consent (Art. 6(1)(a) GDPR), we inform you by email about the launch of the Academy and related offers. A short message to us is sufficient to unsubscribe and withdraw your consent.
  • Free marketing check: on the basis of your consent (Art. 6(1)(a) GDPR), we use your email address solely to send you the check. You may withdraw your consent at any time by email.
  • Penetration quick test: before testing, we verify that you are authorised for the website you entered, and we only carry out tests with your approval.

Newsletter: You can subscribe to our newsletter in the footer and, optionally, beneath each form; the checkbox is not pre-ticked and is separate from any other confirmation. We use your email address on the basis of your consent (Art. 6(1)(a) GDPR, Sec. 7(2) UWG) to send you news on marketing, sales and AI as well as information about our own services and offers. We use the double opt-in procedure: after signing up, you receive an email with a confirmation link, and you are only added to the mailing list once you confirm. We log the sign-up and confirmation (time and IP address) in order to be able to demonstrate your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

Newsletters are sent via Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany), with whom a data processing agreement is in place. You can unsubscribe at any time via the link included in every issue or by email. Once you unsubscribe, we remove your address from the mailing list. To ensure that you receive no further mailings, your address may be retained on a suppression list used exclusively for this purpose (Art. 6(1)(f) GDPR).

Contact by email or phone: If you contact us by email or phone, we process your information (e.g. name, contact details and the content of your request) to handle your request, on the basis of Art. 6(1)(b) or (f) GDPR. The same retention periods apply as for the forms.

Client and contract data: If you engage us, we process the data required to conclude, perform and invoice the contract (Art. 6(1)(b) GDPR). After the end of our cooperation, we retain this data only for as long as statutory retention obligations require. We do not offer online payments on this website, and no payment data is collected here. Invoices are sent by email; payments are received via our business account with the payment service provider Wise, which processes the payment data as an independent controller.

Legal basis and mandatory fields: The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract); for other enquiries, Art. 6(1)(f) GDPR (legitimate interest in responding to your request). For applications, the legal basis is Art. 6(1)(b) GDPR (steps prior to entering into an employment or contractor relationship). Fields marked with * are required for us to process your enquiry; without them, processing is not possible. There is no statutory or contractual obligation to provide this data.

Transmission and recipients: Form entries are not stored in a database and no external form service is used. On submission, your details are transmitted in encrypted form to our web server and forwarded from there by email to the responsible mailbox: enquiries regarding marketing, websites and AI to M.Dincdemir@OptivantaAgency.com, and all other enquiries to E.Dincdemir@OptivantaAgency.com. Emails are sent, received and stored via Google Workspace (section 8). In addition, every enquiry is recorded in our CRM in Notion (section 8). Recipients are exclusively the responsible persons at Optivanta Solutions LLC.

Documentation: Before submitting a form, you confirm via a checkbox that you have taken note of this privacy policy. This confirmation is not a consent to data processing; the legal bases are set out above. For enquiries from Türkiye and China, we additionally obtain your explicit consent to the transfer of your data to the USA and the EU (Art. 9 KVKK, Art. 39 PIPL). The time of this confirmation is attached to your request.

Retention: We delete your data once your request has been fully processed and no statutory retention obligations apply. Business correspondence relevant for commercial or tax purposes is retained for 6 or 10 years respectively. Application documents are deleted no later than 6 months after the selection process has been completed, unless you have agreed to a longer retention period.

Initial business contact: We occasionally contact companies by phone where specific circumstances allow us to presume a genuine interest in our services (Art. 6(1)(f) GDPR, Sec. 7(2) no. 1 UWG). For this purpose, we process publicly available business contact details such as name, role, company, business email address and business phone number. These details are obtained from publicly available sources (e.g. company websites, LinkedIn) and from the B2B data providers Lusha (Lusha Systems Inc.) and Apollo.io; storage takes place in our CRM in Notion (section 8). We inform you about the source of your data at the latest when we first contact you (Art. 14 GDPR). We send marketing emails and our newsletter only with your prior express consent. You may object to being contacted at any time; we record your objection in a suppression list.

6. Cookies and local storage

We only store information on your device, or access information already stored on it, where this is strictly necessary or where you have given your consent (Sec. 25 TDDDG, Art. 6(1)(a) GDPR). On your first visit, we ask for your consent via a cookie banner, in which “Reject all” and “Accept all” are equally prominent.

  • Necessary: your cookie banner preference is saved in your browser’s local storage under “ov-consent-v3” so that we do not ask again on every visit. It remains stored until you change it or clear your browser data.
  • Necessary (language): the language you last viewed is saved in your browser’s local storage under “lang” so that we can remember your language preference. It remains stored until you clear your browser data.
  • Necessary (security): to protect against bots and attacks, Cloudflare may set the cookie “__cf_bm” with a lifetime of 30 minutes. It is technically required (Sec. 25(2) TDDDG) and used exclusively for this purpose.
  • Statistics (consent only): Google Analytics sets the cookies “_ga” and “_ga_<ID>” with a lifetime of up to 2 years (section 7).
  • Marketing (consent only): Leadfeeder sets the cookie “_lfa” with a lifetime of up to 2 years and additionally stores the items “_lfa” and “_lfa_expiry” in your browser’s local storage (section 7).
  • Google Tag Manager (consent only): Tag Manager itself does not set cookies. It is only loaded once you have consented to statistics or marketing (section 7).
  • Cookieless reach measurement: Cloudflare Web Analytics does not set cookies or store anything on your device (section 4).

You can change or withdraw your preferences at any time via the “Cookie settings” link in the footer. We treat your browser’s Global Privacy Control (GPC) signal as a refusal of statistics and marketing.

7. Google Analytics 4, Google Tag Manager and Leadfeeder

With your consent, we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It shows us how visitors use our website, for example which pages are viewed, for how long and from which source, so that we can improve the website.

  • Without your consent, Google Analytics is not loaded and no data is transmitted to Google.
  • Google Analytics 4 does not store full IP addresses. It processes usage data such as pages viewed, time on page, device, browser and approximate location (country, region).
  • Google Signals and the use of data for personalised advertising are disabled.
  • Data is deleted automatically after 2 months.
  • Data may be transferred to the USA. Google is certified under the EU-U.S. Data Privacy Framework; the EU Standard Contractual Clauses also apply. A data processing agreement is in place with Google.

The legal basis is your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG). You may withdraw your consent at any time with effect for the future via “Cookie settings” in the footer. Further information: policies.google.com/privacy

Google Tag Manager (consent only): We use Google Tag Manager, provided by Google Ireland Limited, to manage the integration of Google Analytics and Leadfeeder. Tag Manager is a management tool; it does not set cookies or create profiles. However, when it loads, your IP address is transmitted to Google, including to the USA. We therefore only load Tag Manager once you have consented to statistics or marketing, and it only triggers services in the categories you have consented to (Google Consent Mode). The legal basis is your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG). Google is certified under the EU-U.S. Data Privacy Framework. Further information: policies.google.com/privacy

Leadfeeder – company identification (consent only): With your consent in the “Marketing” category, we use Leadfeeder, provided by Dealfront Group GmbH (Leadfeeder), Durlacher Allee 73, 76131 Karlsruhe, Germany. Leadfeeder matches the IP address of your visit against company databases and shows us which company visited our website, which pages were viewed and for how long. The purpose is to identify companies, not individuals; we do not link this data to any individual. We may add identified companies as company records to our CRM in Notion (section 8), where they are deleted in accordance with the retention periods stated there. Leadfeeder sets the cookie “_lfa” with a lifetime of up to 2 years. The data is hosted within the EU/EEA. Dealfront retains it only for as long as necessary to provide the service and to meet statutory obligations. Without your consent, Leadfeeder is not loaded. The legal basis is your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG), which you may withdraw at any time via “Cookie settings” in the footer. A data processing agreement is in place with Dealfront. Further information: leadfeeder.com/privacy

ProvenExpert – review seal (consent only): On our home page and results page, with your consent in the “Marketing” category, we embed the review seal from ProvenExpert (ProvenExpert GmbH, Quedlinburger Straße 1, 10589 Berlin, Germany). This loads a script from s.provenexpert.net that displays the seal with our rating; in doing so, your IP address is transmitted to ProvenExpert. Without your consent, this script is not loaded and no data is transmitted to ProvenExpert; instead we only show a simple link to our profile. The legal basis is your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG), which you may withdraw at any time via “Cookie settings” in the footer. Further information is available in ProvenExpert’s privacy policy: provenexpert.com/datenschutz

8. Communication, appointment booking and work tools

For email, calendars and video calls, we use Google Workspace, Google Calendar and Google Meet, provided by Google Ireland Limited. When you email us, submit a form or join a video call, your information (e.g. name, email address, message content, and audio and video data during calls) is processed on Google servers. The legal basis is Art. 6(1)(b) or (f) GDPR. Google is certified under the EU-U.S. Data Privacy Framework, and a data processing agreement is in place.

Appointment booking: After submitting the contact form, you can book an initial call directly. For this purpose, we embed the Google Calendar booking page (Google Ireland Limited). It is only loaded after you submit the form; technical data such as your IP address is transmitted to Google. If you book a slot, Google processes your name, email address and the selected time and sends you a confirmation including the video call link. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). Alternatively, you can open the calendar in a new tab or request an appointment by email.

Further communication and collaboration tools: Depending on the preferences of our clients and prospects, we also use the following services. The content exchanged as well as contact and metadata (e.g. name, email address, phone number, time, and audio and video data during calls) are processed by the respective provider. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures and performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in fast and efficient communication and project work).

  • Zoom: Zoom Communications, Inc., 55 Almaden Blvd, San Jose, CA 95113, USA, for video calls. zoom.us/privacy
  • Microsoft Teams: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, for video calls. privacy.microsoft.com
  • WhatsApp Business: WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, for messages if you contact us this way. Content is end-to-end encrypted; WhatsApp receives metadata such as sender, recipient and time. We have disabled automatic address book matching. whatsapp.com/legal
  • Slack: Slack Technologies, LLC, San Francisco, USA, for internal team communication, in which enquiries and client projects may be discussed. slack.com/privacy-policy
  • Notion: Notion Labs, Inc., 2300 Harrison Street, San Francisco, CA 94110, USA, as our CRM and for project organisation and client portals. In the CRM, we store all enquiries submitted via the forms on this website (form type, name, company, email address, language, message and newsletter consent), contact and company details of prospects and clients, notes on calls and meetings, and the status of proposals and projects. The purpose is to handle your enquiry, to prepare and perform contracts and to manage our client relationships (Art. 6(1)(b) and (f) GDPR). We delete the data once it is no longer required for these purposes, and no later than upon expiry of statutory retention periods; enquiries that do not lead to a collaboration are deleted after 2 years at the latest. You may request access, rectification or erasure at any time (section 10). notion.so
  • Claude (Team plan): Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA, an AI assistant we use for internal workflows such as summaries, drafts and reviewing notes. Content from enquiries and client projects may be processed in the process. We use the business version Claude Team, for which a data processing agreement including the EU Standard Contractual Clauses is in place and in which content is not used to train the models. Every result is reviewed by a person. anthropic.com/legal/privacy

Data processing agreements are in place with these providers where offered. Transfers to the USA are based on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (section 9).

9. International data transfers

We are a company based in the USA and work with service providers in the USA and the EU. Your data is therefore also processed in the USA. For transfers from the EU, the EEA, Switzerland and the United Kingdom, we rely on the adequacy decision for the EU-U.S. Data Privacy Framework (including the Swiss-U.S. Framework and the UK Extension) where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

10. Your rights under the GDPR

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), as well as the right to withdraw your consent at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then cease processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Where we process your data for direct marketing purposes, for example for our newsletter, you may object at any time without giving reasons. We will then no longer use your data for this purpose.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the country where you live or work. A simple email to E.Dincdemir@OptivantaAgency.com or a request to our EU representative (section 1a) is sufficient to exercise your rights.

11. Information for users in the United States

This section supplements the privacy policy for residents of the United States, in particular under the California Online Privacy Protection Act (CalOPPA) and, where applicable, the California Consumer Privacy Act (CCPA/CPRA) and comparable laws of other states.

  • Categories collected: identifiers (name, email address, phone number), professional information (company, position, application details), internet and usage data (server log files; analytics data only with consent).
  • Sources and purposes: directly from you via forms and email, and technically when you visit the website; to handle your request, provide our services, and secure and improve the website.
  • No sale, no sharing: we do not sell personal information and do not share it for cross-context behavioural advertising. We do not use sensitive personal information for purposes other than those stated. Company identification via Leadfeeder only runs with your consent; you can switch it off at any time via “Cookie settings” (opt-out).
  • Recipients: only the service providers named in this policy, acting on our behalf.
  • Your rights: where your state’s laws apply, you may request access, correction and deletion, and opt out of sale or sharing. Please send your request to E.Dincdemir@OptivantaAgency.com. We verify your identity before responding and will not discriminate against you for exercising your rights. You may also use an authorised agent.
  • Do Not Track and GPC: we do not respond separately to Do Not Track signals, as analytics data is only collected with consent. We treat the Global Privacy Control (GPC) signal as a refusal of statistics and marketing.
  • Children: our website is aimed at businesses, not children. We do not knowingly collect data from children under 13 (COPPA) or under 16.

12. Information for users in Switzerland and the United Kingdom

For individuals in Switzerland, the Swiss Federal Act on Data Protection (FADP) also applies; for individuals in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply. The rights set out in section 10 apply accordingly. You may lodge complaints with the Federal Data Protection and Information Commissioner (FDPIC) or the Information Commissioner’s Office (ICO).

13. Information for users in Türkiye and China

Türkiye: for individuals in Türkiye, Law No. 6698 on the Protection of Personal Data (KVKK) also applies. You have, in particular, the rights under Art. 11 KVKK, such as access, rectification and erasure. Your data is processed in the USA and the EU to handle your request.

China: for individuals in the People’s Republic of China, the Personal Information Protection Law (PIPL) also applies. When you contact us, your information is processed outside China, in the USA and the EU, solely to handle your request. You have, in particular, the right of access, correction and deletion, and the right to withdraw your consent.

Please send requests to E.Dincdemir@OptivantaAgency.com. We respond in German, English or Turkish; for Chinese, we use translation where necessary.

14. Automated decision-making and AI

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. Enquiries and applications are read and handled exclusively by people. This website has no chatbot, no facial or emotion recognition and no scoring.

We use the AI assistant Claude (Team plan) for internal workflows (section 8). Other AI assistants (e.g. ChatGPT, Gemini, Perplexity) are used only for tasks such as drafting texts and research, without personal data from your enquiries or from client projects. The AI does not make any decisions about you. Some texts and translations are created with AI support and are reviewed by us, and we take full responsibility for them. The team photos are AI-generated and labelled “AI-generated”. Further details can be found in the “AI transparency” section of our imprint.

15. Data security, fonts and links

This website is fully encrypted via TLS (https). In addition, we implement technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, manipulation and unauthorised access. Please note that transmission by email may be subject to security vulnerabilities.

Fonts: the Plus Jakarta Sans font is hosted locally on our server. No connection to Google Fonts or any other font provider is established.

Links to social networks: we link to our LinkedIn and Instagram profiles using simple links only. No plugins are embedded; data is only transmitted when you click a link and open the respective network’s page, where its own privacy policy applies.

Our social media profiles: we maintain company profiles on LinkedIn, Instagram, Facebook and TikTok. If you interact with these profiles (e.g. comment, like or send a message), we process the data you make available there in order to communicate with you and present our company (Art. 6(1)(f) GDPR). The platforms provide us with aggregated statistics about our profiles; for these statistics we are joint controllers with Meta Platforms Ireland Ltd. (Facebook, Instagram) and LinkedIn Ireland Unlimited Company (Art. 26 GDPR). The platforms may also process your data in the USA and other third countries; their own privacy policies apply. TikTok is operated in the EU by TikTok Technology Limited, Ireland.

Social media and search statistics: to plan our posts and evaluate the performance of our profiles and website, we use Metricool (Metricool Software S.L., Spain) and Google Search Console (Google Ireland Limited). Both only provide us with aggregated statistics such as reach, engagement, search queries and clicks; Google Search Console does not set any cookies on this website. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in optimising our channels).

16. Changes to this privacy policy

We update this privacy policy whenever our website, our service providers or the legal situation change. The current version is always available on this page; material changes are indicated by the date below.

Last updated: October 2026