Privacy Policy
Last updated: September 2026
Introduction
This privacy policy explains which personal data we process, for which purposes and to what extent. It applies to our website roiwerk.com as well as to contacting us and working with us. Status: September 29, 2026.
Controller
Appsplosion GbR · Partners: Santino Lopez Seither, Fabian Stehle · Sperlingsweg 5 · 61462 Königstein im Taunus · Germany · Email: appsplosion.help@gmail.com. We have not appointed a data protection officer; the requirements of Art. 37 GDPR are not met. Please send privacy inquiries to the email address above.
Overview of processing
We process inventory data (e.g. name), contact data (e.g. email address, phone number), content data (e.g. form entries, messages, voice notes), usage data (e.g. pages viewed, device information) and meta and log data (e.g. IP addresses, timestamps, server logs). This concerns prospects, contacts, customers and visitors to this website. Processing serves to answer inquiries, provide our services, operate the website securely and, with your consent, to measure reach, measure the success of our advertising and show personalised ads.
Legal bases
We process your data on the basis of your consent (Art. 6(1)(a) GDPR), to perform a contract or pre-contractual steps at your request (Art. 6(1)(b) GDPR), to comply with legal obligations (Art. 6(1)(c) GDPR) and to protect our legitimate interests, provided your fundamental rights do not prevail (Art. 6(1)(f) GDPR). You may withdraw consent at any time with effect for the future.
Security measures
We take technical and organisational measures appropriate to the risk: encrypted transmission (SSL), access restrictions on our systems and procedures to honour your rights and delete data. The forms on this website are processed server-side; internal keys never reach your browser.
Disclosure of data
To provide our services we share data with service providers, for example for hosting, analytics and internal communication. We conclude data processing agreements under Art. 28 GDPR with processors. We share data with third parties for their own advertising only with your consent (Google Ads, see below), and we do not sell your data.
International transfers
Some providers named here are based in the USA or transfer data there (Vercel, Google, Unsplash, Meta as the operator of WhatsApp). Transfers there rely on the EU Commission's adequacy decision on the EU-US Data Privacy Framework, supplemented by the Commission's standard contractual clauses. A list of certified companies is available at dataprivacyframework.gov.
Storage and erasure
We delete your data once its purpose no longer applies and no retention duty stands in the way. Inquiries, including their internal copy, are deleted no later than 12 months after the inquiry is closed. Server logs are kept for a maximum of 30 days. Commercial and tax law may require longer periods (e.g. 6 to 10 years for business records).
Your rights
You have the right of access, rectification, erasure and restriction of processing, data portability and objection to processing based on legitimate interests; you may withdraw consent at any time. You may also lodge a complaint with a supervisory authority, for example in the member state of your residence or at the place of the suspected infringement.
Business services
When you commission a website from us, we process your contact and contract data (name, contact details, project details, billing data) to provide the agreed service: quote, copywriting, launch and care. The legal basis is the contract or pre-contractual inquiries (Art. 6(1)(b) GDPR). We delete business relationship data after warranty periods expire, generally after four years, unless archiving duties apply (for tax purposes, usually ten years).
Hosting and server logs
This website is operated at Vercel Inc. (USA). When you visit, IP address, date and time, page requested, data volume transferred, referrer and user agent are processed in server logs as technically required to deliver the page and operate it securely. The legal basis is our legitimate interests (Art. 6(1)(f) GDPR); data processing agreement under Art. 28 GDPR. Log data is kept for a maximum of 30 days.
Inquiry form and voice notes
Through our forms we ask for an email address or phone number, your message as text and optionally as a voice note (up to 3 minutes), and your answer to “Already have a website?” We also receive technical details from the page address (e.g. campaign and click identifiers such as gclid and UTM parameters) so we can attribute inquiries to campaigns. The details serve to handle your inquiry (Art. 6(1)(b) and (f) GDPR). Unsent entries are stored by your browser locally (localStorage), only on your device. Submitted inquiries are displayed internally for handling; recipients are exclusively the partners of Appsplosion GbR. Inquiries are deleted no later than 12 months after closing.
Contact via WhatsApp
On some pages you can write to us on WhatsApp. The button opens WhatsApp (WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland, a Meta company) with a prefilled message. Only when you send it do we receive your message, your phone number and your WhatsApp profile name. WhatsApp's own privacy policy applies to its processing; Meta may transfer data to the USA. We use the details only to handle your inquiry (Art. 6(1)(b) GDPR); storage follows the same rules as inquiries sent through the form. If you prefer not to use WhatsApp, please use the form.
Cookies and consent
On your first visit a banner asks whether we may use Google Analytics (statistics) and Google Ads (marketing). Until you agree, no Google services load and no cookies are set. Your browser stores your choice locally (localStorage, entry “roiwerk-consent”); this is necessary to respect your decision (Section 25(2) no. 2 TDDDG). With your consent Google sets cookies (e.g. _ga up to 24 months, _gcl_au and _gcl_aw up to 90 days). The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can change or withdraw it at any time with effect for the future via the “Cookie settings” link next to the imprint and privacy links, or at the end of this page; we then delete this website's Google cookies. We pass your choice to Google through Google's Consent Mode so that Google services respect it.
Web analytics
With your consent to “Statistics” we use Google Analytics 4 (Google Ireland Limited, transfer to Google LLC, USA) with IP anonymisation to understand how the website is used (pages viewed, approximate region, device type). We also record events such as starting and sending an inquiry (without its content) and taps on the WhatsApp button. Without consent, Google Analytics does not load. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time under “Cookie settings”. Google is certified under the EU-US Data Privacy Framework.
Google Ads: conversion tracking and remarketing
We run ads through Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; transfer to Google LLC, USA). With your consent to “Marketing”, Google stores a cookie with a click identifier (_gcl_aw, _gcl_au, up to 90 days) when you arrive through one of our ads. If you then send an inquiry or tap the WhatsApp button, our website reports this to Google Ads (a conversion). This shows us which ads and search terms lead to inquiries. Google may also recognise you as a visitor of this website and show you our ads again later on other websites and in Google services (remarketing, personalised ads); for this, Google Analytics is linked to Google Ads as well. Google may use this data for its own purposes too, for example by linking it to your Google account if you are signed in. Google does not learn what you write in the form; we do not send email addresses or phone numbers to Google. Without consent, Google Ads does not load. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw under “Cookie settings”. You can also turn off personalised ads from Google at adssettings.google.com. Google is certified under the EU-US Data Privacy Framework.
Embedded content
The example images on this website load from the image service Unsplash (USA). Your IP address is transmitted to Unsplash; without it the images cannot be displayed (Art. 6(1)(f) GDPR). The fonts on this website load locally from our own server; no transfer to third parties takes place.
Changes to this policy
We adapt this policy when the legal situation or our processing changes. The current version is on this page; the date in the introduction marks its status.