Privacy Policy
This notice explains what personal data we process when you use scopecity.ai, on what legal basis, and what rights you have. It is provided under Articles 13 and 14 GDPR.
1. Controller
The Scope GmbH
Große Theaterstraße 1
20354 Hamburg
Germany
Email: [email protected]
Telephone: +49 (0)40 70 70 8190
We have not appointed a Data Protection Officer, as we are not required to do so under Art. 37 GDPR or § 38 BDSG. Data protection enquiries reach us at the address above.
2. Data we process
2.1 When you submit the contact form
We process the information you enter: your work email address, your company and role, your description of what you are training or validating, and, if you choose to provide it, your notes on what should be examined on the call.
All fields other than the last are required in order to respond meaningfully to your enquiry. Providing them is not a statutory obligation, but without them we cannot process your request.
2.2 When you visit the website
When you access this site, your browser transmits technical data that our hosting provider processes in order to deliver the page and maintain security: IP address, date and time of the request, the page requested, referrer URL, browser type and operating system. This data is necessary to operate the website and to defend against attacks.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry and preparing a possible contract | Art. 6 (1)(b) GDPR — pre-contractual measures at your request |
| Operating, securing and delivering the website | Art. 6 (1)(f) GDPR — our legitimate interest in a functioning, secure website |
| Business communication with prospective and existing customers | Art. 6 (1)(f) GDPR — our legitimate interest in direct business communication |
| Analytics and any non-essential cookies | Art. 6 (1)(a) GDPR — your consent, which you may withdraw at any time |
| Retention required by commercial and tax law | Art. 6 (1)(c) GDPR — compliance with a legal obligation |
4. Recipients and processors
We do not sell personal data. We share it only with processors acting on our documented instructions under a data-processing agreement pursuant to Art. 28 GDPR:
| Processor | Purpose | Transfer safeguard |
|---|---|---|
| Cloudflare, Inc. and Cloudflare Germany GmbH | Website hosting, content delivery and protection against attacks | EU Standard Contractual Clauses; traffic is served from Cloudflare's European edge where possible |
| HubSpot Ireland Ltd. and HubSpot, Inc. | Processing and storage of contact-form submissions in our CRM | EU Standard Contractual Clauses and the EU–US Data Privacy Framework |
Where data is transferred to a third country, it is protected by the safeguards named above. You may request a copy of the relevant safeguards from us at the address in section 1.
5. Cookies and tracking
This website sets no advertising cookies and runs no cross-site tracking.
Cookies that are strictly necessary to deliver the site and keep it secure are set on the basis of § 25 (2) TDDDG and do not require consent. Any analytics or marketing cookies are set only with your prior consent under § 25 (1) TDDDG and Art. 6 (1)(a) GDPR, and you can withdraw that consent at any time with effect for the future.
6. Retention
We keep contact-form data for as long as needed to handle your enquiry and any resulting business relationship. If no business relationship follows, we delete or anonymise the data once it is clear that no further communication is expected, and at the latest after three years from the end of the year in which you contacted us.
Where commercial or tax law requires longer retention — generally six or ten years under §§ 257 HGB and 147 AO — we restrict processing of that data instead of deleting it, and delete it once the period expires.
Server log data is deleted or anonymised after a short period, ordinarily within a few days, unless a specific security incident requires longer analysis.
7. Your rights
Under the GDPR you have the right to:
- Access your personal data and receive a copy (Art. 15)
- Rectification of inaccurate or incomplete data (Art. 16)
- Erasure of your data (Art. 17)
- Restriction of processing (Art. 18)
- Data portability in a structured, machine-readable format (Art. 20)
- Object to processing based on legitimate interests, on grounds relating to your particular situation (Art. 21)
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7 (3))
To exercise any of these rights, write to [email protected].
8. Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany
datenschutz-hamburg.de
9. Automated decision-making
We do not use automated decision-making or profiling within the meaning of Art. 22 (1) GDPR.
10. Changes to this policy
We update this notice when our processing changes or when legal requirements make it necessary. The version published here is the one that applies.
The Scope GmbH · Hamburg · Last updated July 2026 · Imprint