--- title: "Privacy policy: how CompLeadly handles your data" description: "Which personal data CompLeadly processes, on what legal basis, how long it is stored, and the rights you have under the GDPR." url: "https://compleadly.com/privacy" lang: "en" alternates: de: "https://compleadly.de/datenschutz" en: "https://compleadly.com/privacy" fr: "https://compleadly.com/fr/politique-de-confidentialite" es: "https://compleadly.com/es/politica-de-privacidad" it: "https://compleadly.com/it/informativa-privacy" pt: "https://compleadly.com/pt/politica-de-privacidade" x-default: "https://compleadly.com/privacy" --- # Privacy **Last updated: 19 October 2026** ## 1\. Controller The controller responsible for processing personal data on this website is: CompLeadly OHG Hauptstr. 26 51465 Bergisch Gladbach Germany Phone: +49 2202 1860373 Email: info@compleadly.de ### Data protection officer You can contact our data protection officer directly at any time with any questions about the processing of your personal data or the exercise of your rights. You can find the contact details at [Contact details of the data protection officer](https://compleadly.com/knowledge/data-protection-officer). You can also send general questions about data protection at CompLeadly to [datenschutz@compleadly.de](mailto:datenschutz@compleadly.de). ## 2\. General information ### Scope This privacy policy applies to our websites **compleadly.com** (English, French, Spanish, Italian and Portuguese offering) and **compleadly.de** (German-language offering). Both domains are operated by the same controller, provide the same service in different languages and use the same infrastructure, the same processors and the same retention periods. Everything stated in this policy therefore applies to both domains alike. Your choice in the cookie settings is stored separately for each domain. If you visit both, you will be asked for your decision once on each domain and can withdraw it there independently. ### Purposes, legal bases and recipients We process personal data only where necessary to provide and secure the website, handle enquiries and applications, send our newsletter or act on your consent. The relevant legal bases include Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract and pre-contractual steps), Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interests). Access to information on your device is also governed by Section 25 TDDDG. We use processors in particular for hosting, content delivery, object storage, email delivery, CRM and technical communication. They process data only on our instructions and under appropriate agreements. Self-hosted components such as Payload, MongoDB, Redis and Meilisearch are software within our infrastructure and are not separate recipients. ### Retention We retain personal data only for as long as necessary for the relevant purpose. We then delete or anonymise it unless statutory retention duties, the establishment or defence of legal claims, or another lawful reason requires further retention. More specific periods are stated below. ### Your rights Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction and data portability. You may withdraw consent at any time with future effect. Where processing is based on Art. 6(1)(e) or (f) GDPR, you may object on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons. You also have the right to lodge a complaint with a data protection authority. Our competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestr. 2–4, 40213 Düsseldorf, Germany, [www.ldi.nrw.de](https://www.ldi.nrw.de/). ### Encryption The website is transmitted using TLS encryption. Nevertheless, no transmission over the internet can be protected completely against access by third parties. ## 3\. Provision, hosting and security ### Hosting and content delivery The website runs on external server infrastructure and is delivered through Cloudflare services. Our server and data-centre provider is active 1 GmbH, Kritenbarg 66, 22391 Hamburg, Germany; the servers are located in a data centre in Frankfurt am Main, Germany. We have concluded a data processing agreement with the provider under Art. 28 GDPR. As our processor, it processes IP addresses, connection data, server logs and data submitted through forms. The legal bases are Art. 6(1)(b) GDPR where processing serves pre-contractual steps and otherwise Art. 6(1)(f) GDPR. Our legitimate interest is the secure, fast and reliable provision of our online service. ### Cloudflare We use Cloudflare for DNS, CDN, caching, protection against attacks and automated access, edge functions and – depending on the production configuration – private object storage. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA; the contracting entity for European customers may be a European Cloudflare company. Cloudflare processes in particular the IP address, date and time, requested URL, referrer, HTTP headers, browser and device information, and security events. Processing is based on Art. 6(1)(f) GDPR. Our legitimate interests are secure delivery and protection against abuse. Cloudflare may process data in the United States. Where the recipient is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission's adequacy decision under Art. 45 GDPR; Standard Contractual Clauses may be used in addition. Further information: [Cloudflare Privacy Policy](https://www.cloudflare.com/privacypolicy/). ### Server logs, rate limiting and error reports For troubleshooting and abuse prevention, we process technical log data such as time, path, HTTP method, request ID, browser information, error messages, performance values and security reports. IP addresses are hashed with a regularly changing salt in our application and rate-limit logic. These hashes are stored temporarily in Redis for rate limiting. Browser security reports may contain the affected URL and technical information about a blocked resource. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interests are system stability, troubleshooting and security. We store logs in our self-hosted monitoring system (Signoz) and delete them automatically after 30 days; security-related data may be retained until an investigation and the defence or enforcement of claims have been completed. ### Traffic measurement with Umami (cookie-free) For statistical analysis of website usage we use the open-source analytics software Umami, which we operate ourselves on a server in Germany (`asset.complead.ly`). Umami works without cookies and stores nothing in your browser. It records the page visited and its title, the referrer (without its URL parameters), browser and browser language, operating system, device type, screen size, approximate region of origin, technical loading-time metrics and the time spent on the page, as well as interactions with annotated elements (e.g. button clicks). Of the URL parameters we only transmit campaign details (utm\_source, utm\_medium, utm\_campaign, utm\_term, utm\_content); all other parameters, such as search terms or ad click identifiers, are removed in your browser before transmission. In addition, non-personal session attributes such as the selected language, the selected colour scheme and the status of your cookie choices are recorded. Your IP address is only used to determine your approximate location (country, region, city) and to form a pseudonymous session identifier (a hash with a changing salt); it is not stored. Visitors are not tracked across websites, and the measurement data is not passed on to third parties; like the rest of the website, the transmission to our server runs via Cloudflare (see above). We delete the individual records after 24 months. The legal basis is our legitimate interest in statistically analysing and improving our services (Art. 6(1)(f) GDPR). No consent-requiring access to your terminal equipment within the meaning of Section 25 TDDDG takes place. You may object to this processing at any time with effect for the future (Art. 21 GDPR) — most easily directly in the cookie settings via the toggle "Disable cookie-free audience measurement (Umami)" (your choice is stored locally in your browser only), or alternatively by emailing the address given in section 1. ## 4\. Cookies and browser storage We use cookies and comparable browser storage such as Local Storage. Storage or access that is not strictly necessary occurs only with your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Necessary storage is based on Section 25(2)(2) TDDDG and, where personal data is involved, the legal bases stated for the respective processing. You can change your choices at any time under [Cookie settings](https://compleadly.com/privacy#cookie-settings). A detailed and current list of optional services, providers, data categories and storage periods is also available there. - `cl_consent`: consent status and technical consent ID, cookie 12 months; additionally mirrored in Local Storage for cross-tab synchronisation, until deleted in the browser. - `cl_country`: remembers your region assignment for the automatic language redirect (DE/EN) so detection does not run on every visit. Country detection happens at the CDN edge based on your IP address; only the two-letter country code is stored, never the IP address. Strictly necessary (Section 25(2)(2) TDDDG, Art. 6(1)(f) GDPR). Storage period: 90 days. - `promo_variant`: assigned promotional/A/B variant, 30 days; set only after marketing consent and deleted when consent is absent or withdrawn. - `compleadly-theme`: display preference explicitly selected by you, until deleted in the browser. - `cl_contact_wizard`: locally stored contact form draft, 24 hours or until successful submission. - `cl_recent_searches` and `cl_recent_visited`: recent search terms and opened search results, stored locally until deleted in the browser. - `cl_newsletter_dismissed_until`: suppresses the newsletter prompt, 30 days. - `cl_newsletter_subscribed`: locally remembers a successful subscription until deleted in the browser. - `cl_promo_dismissed_`: remembers that a specific notice was dismissed until deleted in the browser. - `umami.disabled`: stores your Art. 21 objection to cookie-free audience measurement, until deleted in the browser. Strictly necessary (Section 25(2)(2) TDDDG). - `cl_trust_dismissed`: remembers that the review widget was dismissed for the current tab session (session storage). - `kb-voted-` / `blog-voted-`: remembers that you have already rated an article, until deleted in the browser. The `cl_preview` cookie is used only by authorised editors to protect previews of unpublished content and is deleted after a short period or when the preview is closed. ## 5\. Forms and communication ### Contact form When you use the contact form, depending on the selected mode we process your name, email address, company, telephone number, message, type of enquiry, project type, timeframe, company size, language, source page and any attachments you choose to upload. A multi-step form draft is stored exclusively in your browser under `cl_contact_wizard` for no more than 24 hours. We store submitted data in our content and administration system. Attachments are placed in private object storage and checked for permitted file types before processing. If the administration system is temporarily unavailable, a submission may be held in private fallback object storage and imported later. To handle and follow up on your enquiry in a structured way, we transmit the details you provide in the respective form to our customer relationship management system (CRM) HubSpot, where a contact is created or an existing contact is updated. Only completed fields are transmitted — depending on the form your name, phone number and company, and for the analysis form the website address and your descriptions of your offer and target audience; your email address is used to match the contact. The content of your message is attached to the contact as a note so that your enquiry can be handled traceably. The provider is HubSpot Ireland Limited, 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland, with affiliated companies in the United States (HubSpot, Inc.). CRM data is currently stored in HubSpot data centres in the United States. The legal basis is Art. 6(1)(b) GDPR for contract-related and pre-contractual enquiries and otherwise Art. 6(1)(f) GDPR. Our legitimate interest is efficient handling. HubSpot, Inc. is certified under the EU-US Data Privacy Framework (verified on 19 August 2026 against the official participant list); Standard Contractual Clauses apply as a fallback. Further information: [HubSpot Privacy Policy](https://legal.hubspot.com/privacy-policy). We send acknowledgements and internal notifications through Resend. The provider is Resend, Inc., 235 Montgomery St, Suite 1168, San Francisco, CA 94104, USA. As our processor, Resend processes email addresses, names and message content for the purpose of email delivery. The legal basis is Art. 6(1)(b) or (f) GDPR. Transfers to the United States may rely on the EU-US Data Privacy Framework adequacy decision and Standard Contractual Clauses. Further information: [Resend Privacy Policy](https://resend.com/legal/privacy-policy). If the corresponding production feature is enabled, a notification containing the name, email address and project type may be sent to our responsible team through Slack. The provider is Slack Technologies, LLC, 415 Mission Street, San Francisco, CA 94105, USA (a Salesforce company). The legal basis is Art. 6(1)(b) or (f) GDPR. Transfers to the United States may rely on the EU-US Data Privacy Framework adequacy decision and Standard Contractual Clauses. Further information: [Slack Privacy Policy](https://slack.com/trust/privacy/privacy-policy). We retain contact enquiries, including uploaded attachments, for 24 months after receipt and then delete them unless a contractual, evidential or statutory retention reason requires longer storage. If an enquiry results in a contract, the necessary data is retained for the applicable commercial and tax retention periods. ### Cloudflare Turnstile The contact and partner forms, as well as the LinkedIn headline generator, use Cloudflare Turnstile to prevent automated submissions. When the widget is loaded and verified, Cloudflare processes in particular the IP address, browser and device signals, interaction and security characteristics, and the verification result. Our server sends the generated token and IP address to Cloudflare for verification. The legal bases are Section 25(2)(2) TDDDG and Art. 6(1)(f) GDPR. Our legitimate interest is protecting our forms and systems against spam and abuse. Information about Cloudflare and international transfers is provided in Section 3. ### Free tools (`compleadly.com/free-tools/…`) On `/free-tools` we offer a set of free, sign-up-free utilities for LinkedIn outreach and email prospecting. The tools process personal data in three categories: - **Browser tools** (e.g. text formatter, character counter, boolean search generator, limits calculator, message check, campaign calculator, email signature generator, email permutator): these tools run **exclusively in your browser**. No input data is transmitted to our servers or to any third party. - **Server tools without AI** (profile checker link mode, video download, email checker): the input (LinkedIn link or email address) is transmitted to our server to answer the request, processed in memory only for the duration of the request and **never stored** — not in a database, not in a file. Server logs contain only the result class (e.g. "MX record found: yes/no") and an IP value hashed with a daily-rotated salt for rate limiting, never the plaintext input. - **AI tools** (headline generator, summary generator, outreach sequence planner, ICP generator): after a dedicated, not-pre-ticked consent checkbox that explicitly names OpenAI, the input is transmitted to OpenAI, L.L.C. (USA), processed there for text generation, and **not stored by us**. The transfer basis for the USA is the EU-US Data Privacy Framework and/or Standard Contractual Clauses (SCC) under OpenAI's Data Processing Agreement (DPA). If the AI request fails or the shared daily budget is exhausted (one quota shared by all four AI tools), the browser generates a result locally from a fixed template — in that case the input never leaves our infrastructure. According to OpenAI, data submitted via the API is not used to train models and is retained for abuse monitoring for up to 30 days. Please do not enter confidential information. Further information: [OpenAI Data Processing Addendum](https://openai.com/policies/data-processing-addendum/). **Turnstile (Cloudflare)**: every server and AI tool is protected against automated abuse by Cloudflare Turnstile. Cloudflare, Inc. (USA) receives technical bot-detection signals, but never the submitted tool data itself. Details on Cloudflare as a recipient, its US location and the transfer basis are covered in this policy's existing Cloudflare Turnstile section. To limit abuse and costs, we briefly count requests to the server and AI tools per hour and per day using a daily-rotated hash of your IP address (retention at most 24 hours). **Legal basis**: Art. 6(1)(b) GDPR (providing the requested feature at your request) for the actual tool use; alternatively Art. 6(1)(f) GDPR (legitimate interest in protecting the forms against abuse) for Turnstile and the IP-hash rate limiting. **Right to object**: Where processing is based on Art. 6(1)(f) GDPR, you may object at any time under Art. 21 GDPR; simply not using the server/AI tools (or using only the browser tools) has the same effect, since no transmission happens without an active request. Contact channel for objections: see the "Controller" section of this privacy policy. For all tools, we count anonymous usage (day, tool, action, language) — without IP address, without the hash value and without your input. These counters are not personal data and are deleted after 24 months. ### Affiliate application For an affiliate application, we process your name, email address, audience size, selected channels, message and internal application status. The data is stored in our administration system and sent to the responsible team through Resend. If the corresponding production feature is enabled, an additional Slack notification containing the name and email address may be sent. The legal basis is Art. 6(1)(b) GDPR where the application initiates a partnership and otherwise Art. 6(1)(f) GDPR. We retain affiliate applications for 24 months after receipt and then delete them unless an evidential or legal-defence reason requires longer storage. If a partnership is established, contractual and statutory retention periods apply. ### Whitelabel questionnaire and offer **Purpose:** If you receive a whitelabel offer from us, we use your information to prepare the set-up of your programme. For this purpose you can fill in an online questionnaire through a personal link, save it as a draft and submit it bindingly. You can also request the link through a form; in that case we process your name, email address, company and, optionally, phone number and message. Like our other forms, the request is stored in our administration system and transmitted to our customer relationship management system (CRM) HubSpot (see “Contact form”). **Data processed in the questionnaire:** company, contact person (name, email address, phone number), admin email addresses, programme and brand details, uploaded logos and legal documents (terms and privacy notices), selected options and wishes, for your own email delivery the server settings and the SMTP password (stored encrypted and not viewable in plain text), and, upon binding submission, the acceptance of the offer with name, role, time and an irreversible hash of your IP address. Saved drafts are stored server-side in our administration system. Only our authorised staff can access your entries. **Legal basis:** Art. 6(1)(b) GDPR (taking steps prior to entering into a contract at your request, and performance of the contract). **Recipients:** The data is stored in our administration system (hosting: see section 3). For internal processing we use Resend for internal email notifications (see “Contact form”) and Trello, a project management service provided by Atlassian. For each submitted questionnaire we create a card in Trello; it contains the company name, programme name, the selected options and technical configuration details (for example support email address and mail server address), the offer total, notes on the implementation and a link to our administration system. We do not transfer contact persons, admin email addresses, passwords or uploaded files to Trello. The provider is Atlassian (Trello), Atlassian Pty Ltd, Sydney, Australia, together with Atlassian US, Inc., San Francisco, USA. This may result in a transfer to third countries, in particular the USA. The basis is the EU-US Data Privacy Framework adequacy decision where the recipient is certified and otherwise standard contractual clauses. Further information: [Atlassian Privacy Policy](https://www.atlassian.com/legal/privacy-policy). **Retention:** Drafts that were never submitted are deleted automatically, including uploaded files, 90 days after your personal link has expired. The invitation data stored with your link (company, contact person, email address and internal notes) is deleted automatically 90 days after the link has expired or been revoked if you have not submitted the questionnaire. Files that you replace or remove in the questionnaire are deleted immediately unless they belong to a version you have already submitted. Submitted questionnaires, acceptances of offers and the related invitation data are stored as order records for as long as they are required to perform the contract and to comply with statutory retention periods. We keep Trello cards only for as long as they are needed to carry out your project. Link requests are deleted after 24 months unless an evidential or legal-defence reason requires longer storage. ### Job applications If you apply to us – for an advertised position or speculatively – we provide the following information under Art. 13 GDPR on how we process your personal data in the application process. **Controller:** CompLeadly OHG, Hauptstr. 26, 51465 Bergisch Gladbach, Germany. Data protection requests can be addressed to the management via the company's known contact channels. **Purposes:** We process the data provided and generated in the application process to assess your suitability, to communicate with you, to conduct the selection process and to decide whether to enter into an employment relationship. **Categories of data:** In particular master and contact data, CV, qualifications, references and certificates, communication data, interview notes, salary and availability details and any other information you voluntarily provide. Special categories of personal data are only processed where this is necessary and legally permitted. **Legal bases:** Depending on the circumstances, in particular Section 26 BDSG in conjunction with Art. 6(1)(b) GDPR; for special categories, Art. 9(2) GDPR in conjunction with the applicable employee data protection law. After the process has ended, limited retention for the defence of legal claims may be based on Art. 6(1)(f) GDPR. A talent pool is only maintained with your separate, voluntary consent. **Recipients and systems:** Access is limited to the persons involved in the process and the IT and communication service providers required for it. The specific systems used depend on the current application process; no general assurance is given that processing takes place exclusively in German data centres. **Retention:** If your application is unsuccessful, your documents are generally deleted after six months, unless a specific legal dispute or another legitimate exception requires longer retention. For a talent pool, the period stated in the separate consent applies. If you are hired, the necessary data is transferred to the personnel file. **Your rights:** Within the statutory scope, you have the rights of access, rectification, erasure, restriction, data portability and objection, as well as the right to lodge a complaint with a data protection supervisory authority. You can withdraw consent at any time with effect for the future. ### Newsletter For the newsletter, we process your email address, language, source page, confirmation status and the dates of confirmation and unsubscription. Registration uses a double opt-in process. The random confirmation token is stored in Redis for seven days. Confirmation and newsletter emails are sent through Resend. At the current stage, no additional external newsletter contact database such as Brevo or Listmonk is synchronised. The legal basis for sending the newsletter is your consent under Art. 6(1)(a) GDPR. Registration and confirmation data is retained to demonstrate consent under Art. 6(1)(c) and (f) GDPR. Registrations that are not confirmed within 30 days are deleted automatically. You may unsubscribe using the link in every email. After you unsubscribe, we keep a record of the unsubscription for three years as evidence; we then process the address only where necessary to demonstrate the previous consent or ensure that the unsubscription is respected. ### Email, telephone and WhatsApp When you contact us by email or telephone, we process your contact details and the content of the communication to deal with your request. The legal basis is Art. 6(1)(b) GDPR for contract-related communication and otherwise Art. 6(1)(f) GDPR. We also offer voluntary contact through WhatsApp Business. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, a Meta group company. In addition to encrypted communication content, WhatsApp processes communication metadata. Use WhatsApp only if you agree to this processing; email, telephone and the contact form are available as alternatives. Further information: [WhatsApp Privacy Policy](https://www.whatsapp.com/legal/privacy-policy-eea). ## 6\. Search and consent records ### Website search Search terms are sent to our own search API and self-hosted Meilisearch software to display matching content. Recent searches and pages opened from search results may be stored locally in your browser. This local history is not sent to an external search provider. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is making our content easy to find. ### Article rating If you rate an article as helpful or not helpful, we only increase a counter on the article; no reference to you is stored. To prevent abuse, we briefly count requests using a hashed IP value. The legal basis is Art. 6(1)(f) GDPR. ### Consent records We keep a consent record to demonstrate your cookie and service choices. It contains the consent ID, time, version of the notice, current and previous choices, language, action and source of the decision, a hash of the IP address, a hash of the user agent and the referrer path on our domain. The record is retained for three years and then deleted automatically. The legal bases are Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR and Art. 6(1)(f) GDPR. Our legitimate interest is demonstrating that consent was properly obtained or withdrawn. ## 7\. Consent-dependent services ### Umami session replay and heatmaps (statistics & usage analysis) With your consent to the “Statistics & usage analysis” category, our self-hosted Umami instance (servers located in Germany) records your visit (session replay) and creates aggregated click and scroll heatmaps from it. Mouse movements, clicks, scrolling behaviour, window size, page navigation including the full page address with URL parameters (for example a search term on our search page) and the visible page content are recorded. Input into form fields is technically masked and never recorded. No cookies are set; recording takes place exclusively on our own server and is not shared with third parties. Recordings are automatically deleted after 30 days. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR (consent). Without your consent no recording takes place; the script required for this is then not loaded. You can withdraw your consent at any time with effect for the future via the [cookie settings](https://compleadly.com/privacy#cookie-settings) — recording then stops immediately. ### Meta Pixel and Google Ads The website is technically prepared to use Meta Pixel and Google Ads conversion tracking. The respective scripts are loaded only where the relevant identifier is enabled in the production environment and you have first consented to the “Marketing and performance measurement” category. Without this consent, these services are not loaded and an existing `promo_variant` cookie is deleted. When used, usage, device, browser, referrer and campaign data and online identifiers may be transmitted to Meta Platforms Ireland Limited or Google Ireland Limited and affiliated companies in the United States. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You may withdraw consent at any time through the cookie settings. Provider information: [Meta Privacy Policy](https://www.facebook.com/privacy/policy/) and [Google Privacy Policy](https://policies.google.com/privacy). ### First-party campaign attribution After you consent to “Marketing and performance measurement”, we store advertising click identifiers (Google, Meta, LinkedIn, Microsoft and TikTok), UTM parameters, referrer, timestamp and a pseudonymous session ID under `compleadly_attribution` in Local Storage. When you continue to the CompLeadly app, these campaign parameters are appended to the app URL. When you click a download, we send the selected operating system, your browser identifier (user agent), any campaign data and a random identifier to the backend of our CompLeadly app; your IP address is technically transmitted as well. The app backend uses the IP address and operating system to match the download to a later first use of the app. We store this data there for 30 days. The entry in your browser expires after no more than twelve months and is deleted when consent is withdrawn. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Affiliate attribution: If you open our website through the referral link of an affiliate partner (parameter `ref`), we pass the partner code on to the sign-up links of our app so that the referral can be attributed. Without your consent we do not store anything on your device. Only if you have consented to “Marketing and performance measurement”, we store the partner code in your browser's local storage (`compleadly_affiliate_ref`) for up to 90 days and, when you download our desktop app, transmit it together with the download notification to our app backend, so that the referral can still be attributed if you register in the app later. The legal basis is Section 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR. You can withdraw your consent at any time in the cookie settings; the entry is then deleted immediately. ### Origin marker when switching to the CompLeadly app When you follow a link from our website to the CompLeadly app, we append the parameter `lp` to the app's address. It contains nothing but the name of the page on our website you came from, for example `lp=pricing`. No data is stored on or read from your device, no identifier is created, and nothing is passed on to third parties. We evaluate this information in aggregated form only, in order to see which content on our website leads to a registration. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in measuring and improving our own offering. You may object to this processing under Art. 21 GDPR using the contact details at the beginning of this policy. ### Product video on the home page The product demo video on our home page is stored on our own media domain and delivered via our CDN provider, with whom a data processing agreement is in place. No data is transferred to third-party video platforms, no cookies are set and no identifiers are stored in your browser. The video starts muted, loops without sound and can be paused at any time. If you have enabled „reduce motion“ or data saver in your system, it does not start automatically at all. No consent is required for this, because no information is accessed on your device and no additional recipient is involved. ### YouTube and Loom Editorial content may include videos from YouTube in privacy-enhanced mode or Loom. An external iframe is loaded only after you consent to the “External embeds” category. Google Ireland Limited or Loom, Inc. (Atlassian), 350 Bush Street, Floor 13, San Francisco, CA 94104, USA then receives in particular the IP address, browser and device information, the page visited and video usage data and may use cookies or Local Storage. If you are signed in to the provider, the visit may be associated with your account. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. The safeguards described in Section 3 apply to possible transfers to the United States. Provider information: [Google Privacy Policy](https://policies.google.com/privacy) and [Loom Privacy Policy](https://www.atlassian.com/legal/loom/privacy). ### Booking (Calendly) On our contact page you can book an appointment with us. Appointment management is handled by Calendly LLC, 1315 Peachtree St NE, Atlanta, GA 30309, USA, acting as our processor under a contract pursuant to Art. 28(3) GDPR. Booking has its own category (“Appointment booking”) in our [cookie settings](https://compleadly.com/privacy#cookie-settings) and is deliberately not bundled with the video embeds — you can decide on each independently. There are two ways to book. First, the **direct link**: it is always available and establishes no connection to Calendly when our page loads. Only your click opens calendly.com in a new tab. Second, the **embedded booking window**: it is loaded only if you have consented to the “Appointment booking” category _and_ then clicked “Load calendar”. Both conditions must be met; consent alone does not load the window. When the booking window loads, Calendly receives in particular your IP address and browser/device data and stores cookies and local storage entries on your device. We measured these on 13 August 2026: `cal_anonymous_id` (365 days), `_calendly_session` (21 days), `referrer_user_id` (14 days), `__cf_bm` (30 minutes) and `_cfuvid` (session) for bot protection, `__stripe_mid` (365 days), `__stripe_sid` (30 minutes) and `m` (400 days, domain m.stripe.com) for fraud prevention by Stripe, and `_dd_s` (15 minutes) for error analysis by Datadog. In local storage, Calendly stores the entries `_cache` and `page_analytics_page_type`. Stripe and Datadog are embedded by Calendly within its own booking window; we have no influence over that integration. If you book an appointment — by either route — Calendly processes your name, your email address and the booking details on our behalf; we receive this data in order to hold the appointment. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). Storing and reading information on your device through the embedded window additionally requires your consent under Section 25(1) TDDDG; you can withdraw it at any time with effect for the future via the [cookie settings](https://compleadly.com/privacy#cookie-settings) — only the direct link is then available again. Processing takes place in the United States. We rely on the EU-US Data Privacy Framework adequacy decision (Art. 45 GDPR), under which Calendly LLC is self-certified, supplemented by the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of our data processing agreement. Despite these safeguards, access by US authorities cannot be entirely ruled out. Further information: [Calendly Privacy Policy](https://calendly.com/privacy). ### Booking (HubSpot Meetings) On our service pages you book appointments via HubSpot Meetings. The booking page at hubspot.compleadly.com is provided by HubSpot Ireland Limited, 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland, as our processor under a contract pursuant to Art. 28(3) GDPR. Booking via HubSpot has its own category in our [cookie settings](https://compleadly.com/privacy#cookie-settings) (“Appointment booking (HubSpot)”), separate from booking via Calendly. There are two ways to book. First, the **direct link**: it is always available and establishes no connection to HubSpot whatsoever when our page loads. Only your click opens the booking page in a new tab. Second, the **embedded booking window**, where we offer it on the page in question: it is only loaded if you have consented to the “Appointment booking (HubSpot)” category _and_ then clicked “Load calendar”. Both conditions must be met; consent alone does not load the window. In both cases HubSpot receives in particular your IP address and browser and device data. We measured on 30.09.2026 and 07.10.2026: the booking page sets the cookie `__cf_bm` (30 minutes) on hubspot.compleadly.com, hubspot.com, hsappstatic.net, hs-scripts.com, hs-analytics.net, hs-banner.com, hsadspixel.net and usemessages.com, which Cloudflare uses for HubSpot to fend off automated access, and stores the entries `__hmpl`, `HUBLYTICS_EVENTS_53` and `rhumb_transition_history` in session storage, which are deleted when the tab is closed. If you book an appointment, HubSpot processes your name, your email address, any further details you enter in the booking form and the booking details on our behalf and stores them as a contact in our customer relationship management system (CRM); we use this data to hold the appointment and handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). Storing and reading information on your device through the embedded window additionally requires your consent under Section 25(1) TDDDG; you can withdraw it at any time with effect for the future via the [cookie settings](https://compleadly.com/privacy#cookie-settings) — only the direct link is then available again. We store the booking data for as long as it is needed to initiate or carry out the business relationship; otherwise the “Retention” section applies. The data is currently stored in HubSpot data centres in the United States; a move to HubSpot's EU data centre has been initiated. We rely for this transfer to the United States on the EU-US Data Privacy Framework adequacy decision (Art. 45 GDPR), under which HubSpot, Inc. is certified, supplemented by the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of our data processing agreement. Despite these safeguards, access by US authorities cannot be entirely ruled out. Further information: [HubSpot Privacy Policy](https://legal.hubspot.com/privacy-policy). ## 8\. External links and editorial systems ### External links and social networks Our website contains ordinary links to external services, for example LinkedIn, Facebook, Instagram, YouTube, X, ProvenExpert, Trustpilot and WhatsApp. Merely loading our website does not establish a connection to these providers through such links. Only when you click a link does your browser request the external page and transmit your IP address and technical connection data. From that point, the respective provider is responsible for its processing. One exception is the direct booking link: if you book an appointment there, this does not happen under the sole responsibility of Calendly or HubSpot but on our behalf and for our purpose — we remain the controller. See the “Booking (Calendly)” and “Booking (HubSpot Meetings)” sections above for details. ### AI-assisted editorial translation Anthropic, PBC, 548 Market Street, San Francisco, CA 94104, USA may be used to translate editorial CMS content. The texts to be translated are transmitted to Anthropic. Form submissions, newsletter data and consent records are not intended for this translation function. Personal content is transmitted only where necessary for the editorial purpose and legally permitted. The legal basis is Art. 6(1)(f) GDPR or, where personal data is involved, the legal basis applicable to the source content. Transfers to the United States may rely on the EU-US Data Privacy Framework adequacy decision and Standard Contractual Clauses. Further information: [Anthropic Privacy Policy](https://www.anthropic.com/legal/privacy). ## 9\. International transfers and changes Some providers may process data outside the European Economic Area. Depending on the recipient, we rely on an adequacy decision under Art. 45 GDPR, in particular the EU-US Data Privacy Framework for certified US organisations, or appropriate safeguards such as the European Commission's Standard Contractual Clauses under Art. 46 GDPR. Despite these safeguards, access by foreign authorities cannot be ruled out completely. Which mechanism applies to which service is stated in the respective section above. We update this privacy notice when our website, the services used or the legal requirements change. The version published on this page is the applicable version. ```json { "@context": "https://schema.org", "@type": "Organization", "@id": "https://compleadly.de/#organization", "name": "CompLeadly", "legalName": "CompLeadly OHG", "description": "LinkedIn automation software for B2B sales and lead generation — since 2019, with data hosted in the EU.", "foundingDate": "2019", "founder": [ { "@type": "Person", "@id": "https://compleadly.de/ueber-uns#person-sebastian-andes", "name": "Sebastian Andes", "jobTitle": "Managing Director · CEO", "url": "https://compleadly.com/about", "image": "https://compleadly.com/images/founders/sebastian-andes-960w.webp", "sameAs": [ "https://www.linkedin.com/in/sebastian-andes/" ], "worksFor": { "@id": "https://compleadly.de/#organization" } }, { "@type": "Person", "@id": "https://compleadly.de/ueber-uns#person-philipp-krapp", "name": "Philipp Krapp", "jobTitle": "Managing Director · CTO", "url": "https://compleadly.com/about", "image": "https://compleadly.com/images/founders/philipp-krapp-960w.webp", "sameAs": [ "https://www.linkedin.com/in/philipp-krapp/" ], "worksFor": { "@id": "https://compleadly.de/#organization" } } ], "url": "https://compleadly.com/", "logo": { "@type": "ImageObject", "url": "https://compleadly.com/brand/compleadly-logo-light.svg" }, "sameAs": [ "https://www.linkedin.com/company/compleadly/", "https://www.facebook.com/CompLeadlyLinkedInSoftware/", "https://www.instagram.com/compleadly/", "https://www.youtube.com/channel/UCNT_aB_ioPgfoAvFclwXvug" ], "contactPoint": [ { "@type": "ContactPoint", "telephone": "+49 2202 1860373", "email": "info@compleadly.de", "contactType": "customer support", "areaServed": "DE", "availableLanguage": [ "German", "English" ] } ], "address": { "@type": "PostalAddress", "streetAddress": "Hauptstr. 26", "postalCode": "51465", "addressLocality": "Bergisch Gladbach", "addressCountry": "DE" } } ``` ```json { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://compleadly.com/#website", "name": "CompLeadly", "url": "https://compleadly.com/", "inLanguage": "en-US", "publisher": { "@id": "https://compleadly.de/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://compleadly.com/search?q={search_term_string}" }, "query-input": "required name=search_term_string" } } ```