Privacy Policy
Scope
This policy describes the processing of personal data when you visit brezella.co, contact Brezella or apply for a job with us. It does not cover independent websites to which we only provide links.
Data controller
The controller is Brezella. For privacy questions and to exercise your rights, contact hello@brezella.co.
Website delivery and security
We use Vercel to host and deliver the website. Requests involve processing IP addresses, timestamps, requested URLs, browser and device information, and technical error and security information. This supports content delivery, troubleshooting and protection against abuse. The basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in a secure, reliable website. The fact that our analytics database does not store full IP addresses does not mean that hosting involves no processing of IP addresses. The current production deployment uses Vercel’s iad1 region in the United States for server functions. Content may be delivered through a worldwide delivery network.
Content and images
Some content and images are delivered through Sanity and its content delivery network. When content is requested directly, the service receives necessary connection data, including the IP address and information about the requested content. The basis is Article 6(1)(f) GDPR and our legitimate interest in reliably delivering and maintaining the website.
Contact enquiries
For enquiries, we process your contact details, message and any phone number or location you provide. The form also transmits the language, source page and receipt time. Name, email address and message are required; phone number and location are optional. We cannot process a form enquiry without the required information. Messages are sent through Resend and handled in our email inbox hosted by Google. Article 6(1)(b) GDPR applies to contract-related enquiries; Article 6(1)(f) GDPR applies to other enquiries, based on our legitimate interest in responding. An enquiry is not consent to advertising.
Job applications
If you apply by email, we process your contact information and application documents to decide whether to establish an employment relationship (section 26(1) of the German Federal Data Protection Act, BDSG). Access is limited to those handling the application and service providers needed for email processing. Please only send information necessary for the application. Inclusion in a candidate pool requires separate consent.
Cookies, local storage and your choices
Necessary storage supports your consent choices and technical website functions. It uses the app_state cookie and the brezella_cookie_consent local storage entry. Your choice remains valid for up to 180 days; material changes require a new choice. Optional language preferences are stored only with your consent. Necessary device access is based on section 25(2)(2) TDDDG; associated processing is based on Article 6(1)(f) GDPR (reliable management of your choices). Optional storage and analytics rely on section 25(1) TDDDG and Article 6(1)(a) GDPR. You can reject optional features and still use the website.
Website analytics
Only with your consent, we record page views, visible sections, scroll depth, selected clicks, form starts and outcomes, language, broad device category, viewport width range and referral source. Approximate country, region and city derived from the connection are included where available. Form contents are not part of these analytics events. A random session identifier (brezella_analytics_session, session storage) links events in a session. A random browser identifier (brezella_analytics_visitor, local storage) recognises returning visits. This is pseudonymous processing, not fully anonymous processing. Identifiers are removed on withdrawal or on the next website visit after consent expires. The session identifier also ends with the browser session. We do not use fingerprinting for this analytics flow or combine it with advertising profiles. Events are sent through our website to a Neon/PostgreSQL database. Full IP addresses are not stored in these event records. The purpose is to improve content, navigation and usability.
Vercel Web Analytics and Speed Insights
After you consent to analytics, we also load Vercel Web Analytics and Speed Insights. Web Analytics records page views and selected interactions. Speed Insights measures loading performance and technical performance metrics. Processing includes page URLs, referral sources, and browser, device and connection information. Query parameters and URL fragments are removed from the recorded page URL before transmission. Processing serves to analyse and improve the website and relies on Article 6(1)(a) GDPR and, where device access is involved, section 25(1) TDDDG. Withdrawal blocks further analytics events. Vercel processes data according to its service-specific privacy information; these services are separate from our own event database.
Consent management and withdrawal
You can change your choice at any time through “Cookie settings”. Withdrawal applies to future processing and does not affect the lawfulness of earlier processing. Saving a choice sends a technical event containing categories, time and the source of the choice (banner or dialog). It contains no browser identifier, page URL, language, device category, referral source or location information. The basis is Article 6(1)(f) GDPR and our legitimate interest in checking the operation of consent management. This aggregate event is not an individual record proving consent. Marketing services are not currently integrated, and your current choice does not authorise future marketing services.
Recipients and international processing
Depending on the function, hosting and content providers (Vercel, Sanity), database providers (Neon) and email providers (Resend and Google) receive the data required for their tasks. Processing outside the European Economic Area, particularly in the United States, may occur. This requires compliance with Articles 44 et seq. GDPR, such as an applicable adequacy decision or appropriate safeguards including EU Standard Contractual Clauses. The linked provider documents describe their arrangements. Contact us for information about the recipients and transfer safeguards applicable to your data and for a copy of the relevant safeguards. Statutory disclosure obligations remain unaffected.
Retention
Raw data in our own website analytics is scheduled for deletion after 180 days through a daily cleanup. This period does not automatically apply to the separate Vercel services or technical hosting logs. Their retention depends on the service, the configuration in use and any continuing security or evidentiary purpose. Contact and application data is retained only as long as needed to handle the matter, fulfil statutory retention duties or establish, exercise or defend legal claims. Data is deleted when its purpose ends and no further legal basis applies. Data relating to a resulting employment relationship continues to be processed for that relationship. Contact us with questions about the specific retention of your data.
Your rights
Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability (Articles 15–20 GDPR). For processing based on legitimate interests, you may object on grounds relating to your particular situation (Article 21 GDPR); you may object to direct marketing at any time. You can withdraw consent at any time for future processing. You may complain to a data protection supervisory authority, particularly where you live or work or where an alleged infringement occurred. The authority for our business location is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg. We do not make solely automated decisions through this website that have legal or similarly significant effects within Article 22 GDPR.
External links and updates
Links to social networks or other websites lead to independent services. Following a link opens that service, where its own privacy information applies. We update this policy when our processing or legal requirements change. An update to this policy does not expand an existing consent.
Provider and supervisory authority information
- Vercel — Data Processing Addendum
- Vercel Web Analytics — Privacy
- Sanity — Data Processing Addendum
- Neon — Platform Terms
- Resend — Data Processing Addendum
- LfDI Baden-Württemberg
- Google — Cloud Data Processing Addendum
Privacy contact: hello@brezella.co
Last updated: 20 October 2026