Privacy Policy
1. Controller
Esther Berlad, Esther Berlad Branding, Oehlerstr. 31, 38820 Halberstadt, Germany
Email: estherberlad@gmail.com
This policy explains what personal data is processed when you visit this website, in line with the EU General Data Protection Regulation (GDPR).
2. Hosting and server log files
This website is hosted on Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, with servers worldwide including in the EU). When you open the site, Cloudflare processes technical data such as your IP address, date and time of the request, the requested page, browser type and operating system. This is necessary to deliver the site securely and reliably. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in a secure and efficient website). Cloudflare is certified under the EU-US Data Privacy Framework, and data transfers are additionally covered by standard contractual clauses.
On the audit page, Cloudflare Turnstile runs a spam check. This loads a script from Cloudflare and processes your IP address and browser signals for that purpose, to tell visitors from automated bots and protect the audit from abuse. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in protecting the site from spam and misuse).
3. Cookies, tracking and fonts
This website does not use cookies for tracking, does not use analytics or advertising tools, and does not embed social media plug-ins such as like or share buttons. The only embedded third-party content is the subscribe form of my newsletter provider Substack on the home page and the blog page (see section 6). Fonts are loaded from this website itself, not from third-party servers, so no data is sent to Google or other providers for that purpose. The only third-party script on this site is Cloudflare Turnstile on the audit page, described above.
The site stores two short values in your browser’s session storage. The first keeps your audit answers, and the contact details you have typed so far, so that reloading the page does not lose them. The second records which link brought you to the site (a short channel name such as “linkedin”), which I use to see which channels work; it is sent along with your audit submission and added to the Calendly link. Both are cleared when you close the tab (the first also as soon as you submit the audit), neither contains a tracking or user ID, and neither is sent to third parties.
4. Contacting me
If you contact me by email or WhatsApp, I process the data you send (for example your name, contact details and your message) to answer your enquiry and, if applicable, to prepare or carry out a contract. The legal basis is Art. 6 (1)(b) or (f) GDPR. I delete the data once it is no longer needed and no statutory retention duties apply. Messages via WhatsApp are processed by WhatsApp Ireland Ltd. / Meta under its own privacy policy. If you prefer, please use email.
5. Brand Audit
When you take the Brand Audit, the form collects your first name, last name and email address, and optionally your phone number and company, together with your answers, the stage your company is at and your one-line description of it. I use this to calculate your score and send you the results. The legal basis is Art. 6 (1)(b) GDPR, because you asked for the results.
I receive each submission by email, and it is also stored in my Notion workspace, which I use to keep track of enquiries. Notion is provided by Notion Labs, Inc. (USA), which acts as a processor on my behalf. Transfers to the USA rely on the EU-US Data Privacy Framework and on standard contractual clauses. The legal basis is Art. 6 (1)(f) GDPR, my legitimate interest in keeping an orderly record of enquiries.
I delete audit submissions 24 months after our last contact, unless we go on to work together, in which case contract and statutory retention rules apply.
If you tick the follow-up box, I may contact you about your results. The legal basis for this is your consent under Art. 6 (1)(a) GDPR, which you can withdraw at any time by replying to the email.
Emails are sent through Resend (Resend Inc., USA), using their EU data region. Resend acts as a processor on my behalf under a data processing agreement. A copy of each email also remains in Resend’s sending log for a limited period. The spam check on the audit page is described in section 2.
6. Blog and Substack
The blog section displays posts from my newsletter on Substack. My server retrieves the public post feed from Substack, so your browser does not contact Substack to load the list of posts. The subscribe form on the home page and the blog page, however, is embedded from Substack: when it loads, your browser connects directly to Substack’s servers and transmits your IP address to them. When you open a post in the reading window, images in that post may be loaded directly from Substack’s servers, which transmits your IP address to them. If you click “Subscribe” or “Read on Substack” you leave this website, and Substack Inc. (USA) processes your data under its own privacy policy.
7. Links to other websites
This website links to Instagram, LinkedIn and WhatsApp. These are plain links: no data is transferred to these providers until you click one. After that, the respective provider’s privacy policy applies.
Booking a call (for example with the “Let’s Talk” buttons) takes you to Calendly (Calendly LLC, USA). No data is transferred to Calendly until you click, and then Calendly processes the data you enter there under its own privacy policy.
8. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests (Art. 15–21 GDPR). You can withdraw any consent at any time with effect for the future. These rights apply in particular to the audit submission stored in my Notion workspace and to the emails described in section 5: on request I will send you a copy, correct it or delete it, and you can object to its storage at any time. To exercise your rights, write to estherberlad@gmail.com.
You also have the right to lodge a complaint with a data protection authority. The authority responsible for me is the Landesbeauftragte für den Datenschutz Sachsen-Anhalt (State Commissioner for Data Protection of Saxony-Anhalt).
9. Changes
I may update this policy when the website or legal requirements change. The current version is always available on this page.