Privacy policy
Onsano GmbH is in formation (i. Gr.). The company was founded by notarial deed on 2 September 2026; registration in the commercial register at the Local Court of Charlottenburg has been applied for.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Onsano GmbH i. Gr., Rüdesheimer Straße 11, 80686 München, Germany
Represented by the managing directors David Josef Alesch, Sebastian Pietro Marie Graf von Kageneck
Email: info@onsano.com
2. Hosting and server log files
This website is hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Cloudflare processes this data on our behalf (Article 28 GDPR) and is certified under the EU-U.S. Data Privacy Framework. When the website is accessed, the hosting provider automatically collects technically necessary information in server log files transmitted by your browser: IP address, date and time of the request, page accessed, amount of data transferred, referrer URL, browser type and version, and operating system. This processing ensures the reliable and secure operation of the website and is based on our legitimate interest under Article 6(1)(f) GDPR. Consent is not required. Log files are automatically deleted after a limited period and are not combined with other data sources.
3. Cookies and local storage
The cookie banner itself does not set cookies. Your decision (accepted/declined) is stored as technically necessary information in your browser’s local storage. This is used only to avoid showing the banner again on your next visit and is permitted without separate consent under Section 25(2)(2) TTDSG and Article 6(1)(f) GDPR. Google Analytics cookies are set only after you expressly consent to the web analytics described in Section 4.
4. Web analytics (Google Analytics)
We use Google Analytics, a web analytics service from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (or Google LLC, USA), only with your express consent under Article 6(1)(a) GDPR. Without consent, no analytics cookies are set and no data is transferred to Google. The script is loaded technically only after you click “Accept”. Google Analytics processes information including a shortened or anonymised IP address, device and browser information, pages visited, time spent and source of access to create pseudonymous usage statistics. Data may be transferred to the USA. Google participates in the EU-U.S. Data Privacy Framework or relies on standard contractual clauses [add details based on final configuration]. You may withdraw consent at any time for the future by selecting “Decline” in the banner or deleting this website’s local storage in your browser.
5. Appointment booking (Cal.com)
We integrate the Cal.com booking service to arrange calls (Cal.com, Inc., USA [add exact provider information and data processing agreement]). When you book through the “Schedule a call” button, Cal.com processes the information you enter, generally your name, email address and chosen appointment, to complete the booking. The legal basis is Article 6(1)(b) GDPR for steps taken at your request before entering into a contract. Data may be transferred to the USA. Further information is available in Cal.com’s privacy policy. The booking module loads only when you actively click the relevant button.
6. Contact by email
If you contact us by email, we process the data you provide, including your email address and the information in your message, solely to handle your enquiry. The legal basis is Article 6(1)(b) GDPR where the enquiry relates to entering into a contract; otherwise it is Article 6(1)(f) GDPR, based on our legitimate interest in responding to enquiries.
7. Pitch-deck viewer (deck.onsano.com)
To view our pitch deck at deck.onsano.com, you enter your email address. We then process your email address, the time of your visits, which slides you open and how long each slide is visible, your browser and device type (user agent) and the country derived from your connection. We do not store your IP address. A technically necessary cookie keeps you signed in to the deck for up to 30 days. Your email address is shown as a faint watermark on the slides. We use this data to share the current version of the deck in a controlled way and to follow up on your interest. The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in investor and business relations. The data is stored with Neon (Neon, Inc., USA; database hosted in Frankfurt, Germany) and processed by our hosting provider Vercel (Vercel Inc., USA), both acting on our behalf (Article 28 GDPR). We delete the data when it is no longer needed for this purpose, at the latest 24 months after your last visit, or earlier on request. You may object to this processing at any time (Article 21 GDPR) by writing to info@onsano.com.
8. Fonts
Fonts used on this website are self-hosted and delivered only from our own server or hosting provider. No connection is made to Google Fonts or other external font services, so no data, particularly your IP address, is transferred to third parties for this purpose when you visit the website.
9. Recipients and transfers to third countries
Apart from the service providers named in Sections 2, 4, 5 and 7, we do not disclose your data to third parties unless required by law. Where providers process data outside the EU/EEA, particularly in the USA, this is based on suitable safeguards such as the EU-U.S. Data Privacy Framework or standard contractual clauses under Article 46 GDPR.
10. Storage period
We store personal data only for as long as required for the relevant processing purpose or by statutory retention obligations. Server log files are automatically deleted after a limited period. Analytics data is subject to the retention periods configured in Google Analytics [add final configuration].
11. Your rights
Subject to the statutory requirements, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), and objection to processing based on legitimate interests (Article 21). You may withdraw consent at any time for the future (Article 7(3)). Contact info@onsano.com.
12. Right to complain to a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
13. Changes to this privacy policy
We will update this privacy policy when changes in the law, the services used or the company structure, particularly following formation, make this necessary. The version published on this page at the time of your visit applies.