Skip to content

Privacy policy

1. Controller

JADAKA UG (haftungsbeschränkt)
Senckenbergturm
Senckenberganlage 19, 60325 Frankfurt am Main, Germany
Email: hello@jadaka.eu

2. Your rights

Subject to the applicable legal conditions, you have the right to:

  • access the data we process about you (Art. 15 GDPR),
  • have inaccurate data corrected (Art. 16 GDPR),
  • have your data erased (Art. 17 GDPR) or its processing restricted (Art. 18 GDPR),
  • receive your data in a portable format or have it transmitted to another controller (Art. 20 GDPR),
  • object to processing (Art. 21 GDPR),
  • withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR),
  • lodge a complaint with a supervisory authority (Art. 77 GDPR).

Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21(1) GDPR).

3. Hosting and technical logs

This website is hosted by Vercel Inc., USA. When you visit the site, we process data including IP addresses, requested URLs, timestamps, browser information and technical status data to deliver the site, investigate errors and prevent abuse. The legal basis is our legitimate interest in a secure, properly functioning website (Art. 6(1)(f) GDPR).

Vercel uses a global delivery network, so processing is not confined to Europe. According to Vercel, logs and analytics data in our Vercel account are kept for no more than 30 days.

4. Contact and email delivery

If you write to us through the form, we process your name, email address, message and, if you provide it, your company name, in order to respond to your enquiry. We need your name, email address and message to reply; without them we cannot respond. Giving your company name is optional. Where the enquiry concerns a contract with you personally, the legal basis is Art. 6(1)(b) GDPR; otherwise – for example when you write on behalf of your company – it is our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). The same applies if you call us or email us directly.

The form sends your message and a confirmation through Resend, a service provided by Plus Five Five, Inc., USA. Resend processes sender and recipient details, message contents and delivery information.

For our email, we use Google Workspace, provided by Google Cloud EMEA Limited, Ireland. Google processes message contents, addresses and technical metadata.

To prevent abuse, we count submissions per IP address; the count is discarded after one hour. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

5. Appointment booking and video calls

For booking appointments, we embed the calendar of Cal.com, Inc., USA. It loads only when you open “Book an intro call” or follow a link that leads directly to the calendar. From then on, technical connection data such as your IP address and browser information is transferred to Cal.com, and Cal.com may set cookies necessary to run the calendar. The legal basis is our legitimate interest in offering you a simple way to book appointments (Art. 6(1)(f) GDPR); for access to your device we rely on § 25(2) no. 2 TDDDG, because you expressly request the calendar.

When you book, Cal.com processes the details you enter, including your name, email address, appointment and time zone, to arrange and manage the call, including confirmations and changes. The legal basis is Art. 6(1)(b) GDPR where the call concerns a contract with you personally; otherwise it is our legitimate interest in arranging calls with businesses (Art. 6(1)(f) GDPR).

We use Google Meet, part of Google Workspace, for video calls. This involves processing data including your name, connection data and any audio, video or screen content you share. The purpose and legal basis are the same as for handling your enquiry (section 4).

With the prior consent of everyone taking part, we have calls transcribed and summarised by Google Meet’s AI feature (Gemini) and analyse the notes and summaries with our own AI system. This helps us keep track of outcomes, tasks, agreements and decisions and prepare for the next call. Notes and summaries are stored in our Google Workspace account, and Google processes them on our behalf. Our AI system and the language models it uses are operated by service providers on our behalf, some of them also outside the EU (section 10). The legal basis is your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time with effect for the future. We delete notes, summaries and our analysis no later than six months after the call.

Tasks, agreements and decisions that we add to our project records are kept for the duration of the engagement. The legal basis is our legitimate interest in keeping a clear record of our work together (Art. 6(1)(f) GDPR) or, if you yourself are our contracting party, the performance of the contract (Art. 6(1)(b) GDPR). Withdrawing your consent does not affect these records; where they are based on our legitimate interest, you can object (section 2). Once the engagement has ended, we delete them unless we keep them longer under section 11.

6. Website analytics

We use Vercel Web Analytics to evaluate how the website is used: page views and individual events, such as a form submission. It collects the page path, referrer, timestamp, approximate location (country, region, city), operating system, browser and device type. The service sets no cookies. It distinguishes visits using a hash derived from the request, which Vercel says it discards after 24 hours. The legal basis is our legitimate interest in measuring website use to a limited extent (Art. 6(1)(f) GDPR).

7. LinkedIn Insight Tag

With your consent, we use the LinkedIn Insight Tag provided by LinkedIn Ireland Unlimited Company, Ireland. It lets us evaluate our LinkedIn advertising, measure conversions and show ads to previous visitors to our website (retargeting). LinkedIn also processes this data for its own purposes as a controller.

We are responsible for embedding the tag on our website and for the transfer of data to LinkedIn; LinkedIn alone is responsible for any further processing.

LinkedIn receives information including the visited URL, referrer, IP address, device and browser details, timestamp and interactions such as button clicks. Cookies and similar identifiers may link a visit to a LinkedIn account.

The legal bases are your consent under Art. 6(1)(a) GDPR and, for cookies and other access to your device, § 25(1) TDDDG. You can withdraw consent at any time through “Cookie settings” at the bottom of the page, without affecting the lawfulness of earlier processing.

LinkedIn also processes data in the US (section 10). According to LinkedIn, directly identifying information is removed within seven days, and the remaining pseudonymised data is deleted within 180 days. LinkedIn’s cookies are stored for up to one year; the LinkedIn Cookie Table gives the details.

8. Reaching out through professional networks

We also contact people at companies ourselves, mainly on LinkedIn. In doing so, we process your name, job title, company and other details from your publicly visible profile, as well as the content of our messages. These details come from your LinkedIn profile.

We want to get in touch with you and find out whether working together could be worthwhile for your company. The legal basis is our legitimate interest in establishing business contacts (Art. 6(1)(f) GDPR).

Objection to direct marketing: You can object to being contacted at any time, without giving reasons (Art. 21(2) GDPR), for example by email to hello@jadaka.eu. So that we do not contact you again, we keep only your name and profile URL on a suppression list for as long as we contact people through professional networks. The legal basis is our legitimate interest in respecting your objection permanently (Art. 6(1)(f) GDPR).

If you do not reply, we delete your details no later than six months after our last message. If a conversation follows, the periods in section 11 apply.

Our LinkedIn company page: For the page statistics (“Page Insights”), we are joint controllers with LinkedIn Ireland Unlimited Company, Gardner House, Wilton Plaza, Wilton Place, Dublin 2, Ireland (Art. 26 GDPR).

To produce them, LinkedIn uses information from visitors’ profiles, such as job function, industry, country and seniority, and whether someone follows our page. For visits to our page, LinkedIn only shows us aggregated figures; we can see who follows our page, along with their employer and the date they started following. The legal basis is our legitimate interest in understanding how our page is used (Art. 6(1)(f) GDPR). Under the Page Insights Joint Controller Addendum, LinkedIn has undertaken to meet the GDPR obligations for Page Insights, including informing you and responding to requests such as those for access or erasure. LinkedIn keeps the data for the periods set out in its privacy policy. You can exercise your rights with LinkedIn and with us (Art. 26(3) GDPR).

9. Browser storage

We store your cookie choice in your browser’s local storage for 180 days so that we can apply your decision (§ 25(2) no. 2 TDDDG; Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR).

10. Recipients and transfers to third countries

Vercel, Resend, Cal.com, Google and LinkedIn also process data in the US. The European Commission has adopted an adequacy decision for the US (EU-US Data Privacy Framework), and the providers named are certified under it.

Our AI system and the language models it uses are operated by several service providers, some of which also process data outside the EU, namely in the US. We base these transfers on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on EU standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards from us.

11. Retention

Enquiries and appointment records that do not lead to an engagement are deleted no later than six months after the last message. If a business relationship follows, we keep business correspondence for six years, accounting vouchers for eight years and books and annual financial statements for ten years (§ 257 HGB, § 147 AO). Data we need to establish or defend legal claims is kept until the limitation period ends. The same periods apply to service providers acting on our behalf; according to Resend, delivery logs are deleted after 30 days. LinkedIn, as an independent controller, applies its own periods (sections 7 and 8).

Last updated: October 2026.