DE

Overview

Privacy | Cookies

Last updated: 28 September 2026

Thank you for your interest in ALPHA POOL. Below we explain which data we process when you visit this website and when you use our forms, on what legal basis this happens, and which rights you have. This is a translation of the German version. In case of any discrepancy, the German version prevails.

1. Controller

ALPHA POOL GmbH
Kaiser-Friedrich-Strasse 90
10585 Berlin
Germany

Managing directors: Frank Bojack, Daniel Niemeier
Local court Charlottenburg, HRB 86101B
VAT identification number: DE 224 134698

Telephone: +49 30 887 128 60
E-mail: office@alpha-pool.com

For data protection matters you can reach us at the same address.

2. Data protection officer

We are not required to appoint a data protection officer. For all data protection matters please contact us at the address given under section 1.

3. Your rights

You have the following rights towards us:

  • Access to whether and which data we process about you, Article 15 GDPR
  • Rectification of inaccurate data, Article 16 GDPR
  • Erasure, Article 17 GDPR
  • Restriction of processing, Article 18 GDPR
  • Data portability, that is, release in a commonly used format, Article 20 GDPR
  • Objection to processing we base on a legitimate interest, Article 21 GDPR
  • Withdrawal of consent with effect for the future, Article 7 paragraph 3 GDPR. Processing carried out up to the withdrawal remains lawful.

An informal message to the address given under section 1 is sufficient. We respond within the statutory period of one month.

Independently of this you may lodge a complaint with a supervisory authority, Article 77 GDPR. The authority responsible for us is:

Berliner Beauftragte fuer Datenschutz und Informationsfreiheit
Alt-Moabit 59-61, 10555 Berlin, Germany
Telephone: +49 30 13889-0
E-mail: mailbox@datenschutz-berlin.de

4. Visiting this website

4.1 Delivery and server logs

When you open a page, your browser transmits technically necessary data: IP address, date and time, the address requested, the page visited before, and browser and operating system identifiers. Without this data the page cannot be delivered.

Purpose: delivery, operational security, defence against attacks, troubleshooting.
Legal basis: Article 6 paragraph 1 point f GDPR. Our legitimate interest lies in the secure and stable operation of the website.
Retention: log data is deleted automatically, as a rule after seven days and at the latest after 14 days. We keep it longer only where a security incident requires retention as evidence.

4.2 Cookies

This website sets only those cookies that are technically necessary for operation. We do not set cookies for analytics, advertising or recognition across websites. That is why there is no consent banner on this website.

Set on every visit, by our operating platform:

  • session-id assigns your requests within a visit to the correct server instance. Duration: session, ends when you close the browser.
  • __dpl makes sure that all parts of a page come from the same program version. Duration: session, at most 30 days.

Set only when you sign in to your customer account:

  • ap_shop_sitzung_kurz keeps you signed in during the visit. Duration: session, ends when you close the browser.
  • ap_shop_sitzung keeps you signed in if you choose to stay signed in. Duration: 30 days.

Both sign-in cookies are encrypted, cannot be read by scripts in the browser, and are transmitted only over a secure connection. They contain no credentials.

Legal basis: Section 25 paragraph 2 number 2 TDDDG (German Digital Services Data Protection Act), together with Article 6 paragraph 1 point b GDPR for the sign-in cookies and Article 6 paragraph 1 point f GDPR for the platform cookies.

4.3 Storage on your device

Besides cookies, the website stores two entries in your browser's local storage. Section 25 TDDDG applies to these as well, and both are necessary for the service you requested. They are not transmitted to us and do not leave your device.

  • ap_shop_korb remembers the services you placed in your enquiry basket so that they survive a change of page. Duration: until you empty the basket or clear the website data in your browser.
  • tsr-scroll-restoration-v1_3 remembers your position on the page so that you return to it when you go back. Duration: ends when you close the browser tab.

The enquiry basket entry is created only once you place a service in the basket. Neither entry contains any information about you personally.

Legal basis: Section 25 paragraph 2 number 2 TDDDG, together with Article 6 paragraph 1 point f GDPR.

4.4 Fonts

The fonts used are hosted on our own server. No connection to Google Fonts or any other external font service is established when you visit the site.

4.5 Images

Images are loaded from our file storage at Supabase, which is operated in the Frankfurt am Main region. Your IP address is transmitted to that service because it is technically necessary for retrieval.

4.6 Audience measurement

No audience measurement, user tracking or profiling takes place on this website. We use neither Google Analytics nor any comparable tool. No social media buttons that transmit data to third parties are embedded.

5. Our forms

5.1 Enquiry, quotation, briefing and partner request

When you submit one of these forms, we process the details you enter: name, company, e-mail address, telephone number, your message, and the page the enquiry came from. We also store the time of your consent to be contacted.

Purpose: handling and answering your enquiry, preparing a quotation, initiating and performing a business relationship.
Legal basis: Article 6 paragraph 1 point b GDPR for enquiries aimed at a contract, together with Article 6 paragraph 1 point f GDPR for other enquiries. Our legitimate interest lies in answering matters addressed to us.
Recipients: our e-mail service provider, see section 7.
Retention: enquiries that do not lead to a contract are deleted after twelve months. Where an enquiry leads to a contract, the commercial and tax retention periods of six and ten years respectively apply under Section 257 HGB and Section 147 AO.

Name and e-mail address are required because otherwise we cannot reach you. All other details are optional.

5.2 Talent Pool

When you apply to the Talent Pool, we process the details from the form and the files you upload, such as photographs and documents. The files are held in our file storage at Supabase in Frankfurt am Main.

Purpose: assessment of your application and, if accepted, placement on suitable projects.
Legal basis: Article 6 paragraph 1 point b GDPR for the assessment of your application as a pre-contractual measure. For storing your data and files during the assessment, and for inclusion in our talent database after an acceptance, we rely on your consent under Article 6 paragraph 1 point a GDPR, which you give expressly in the form. We store the time of your consent.

Your application is deleted automatically:

  • seven days after our decision, whether acceptance or rejection
  • at the latest 30 days after receipt if no decision has been taken by then
  • uploaded files without a matching application after 24 hours

If your application is accepted, we transfer your data into our talent database within the seven day period. We store it there until you withdraw your consent. We review the database regularly and delete data for which there is no longer a placement purpose.

Withdrawal: you may withdraw your consent informally at any time. We then delete your data and files without delay.

5.3 Customer account

To register a customer account we process the details from the registration form. We review every registration before we activate an account.

Purpose: setting up and administering your access.
Legal basis: Article 6 paragraph 1 point b GDPR.
Retention: for the lifetime of the account. After the account is deleted we remove your data within 30 days, except for data subject to a statutory retention period.

5.4 Protection against misuse

To prevent automated bulk submissions, we limit the number of submissions per sender within a short period. To do so we derive a non-reversible check value from your IP address using SHA-256, together with a salt that changes daily. The IP address itself is not stored. The check value is held solely in volatile memory and expires after at most five minutes. It is never written to a database or a log.

Purpose: defence against spam and automated attacks.
Legal basis: Article 6 paragraph 1 point f GDPR. Our legitimate interest lies in keeping our forms functional.

6. Sending e-mail

After you submit a form you receive a confirmation of receipt, and we receive an internal notification. We use a service provider for sending, see section 7. The details from the form are transmitted to that provider as far as they are needed for sending.

Legal basis: Article 6 paragraph 1 points b and f GDPR.

7. Recipients and processors

We use service providers that process data exclusively on our instructions. A data processing agreement under Article 28 GDPR is in place with each of them.

  • Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, USA. Operation and delivery of the website. Your form entries and sign-in data pass through these servers before they reach our database. They are not stored there. Representative in the EU and data protection officer: Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden, dpo@lovable.dev
  • Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. Database and file storage. Our data is held in Frankfurt am Main, region eu-central-1.
  • Brevo GmbH, Koepenicker Str. 126, 10179 Berlin, Germany. Sending e-mail. Parent company: Sendinblue SAS, Paris.

These providers in turn use sub-processors, for example for data centres and the delivery network. They are contractually bound by the same obligations. Each provider publishes its current list, and we are informed before changes take effect.

Beyond this we pass on your data only where you have consented, where it is necessary to perform a contract, or where we are legally obliged to do so.

8. Transfers to third countries

Our database and our file storage are operated within the European Union, in Frankfurt am Main.

Two of the providers named under section 7 are established outside the European Union, Lovable in the United States and Supabase in Singapore. For these transfers the Standard Contractual Clauses of the European Commission apply under Article 46 paragraph 2 point c GDPR, Implementing Decision 2021/914 of 4 June 2021, modules two and three. The same applies to transfers our providers make to their own sub-processors outside the European Union.

We will provide you with a copy of the safeguards on request.

9. No automated decision making

We do not use automated decision making or profiling within the meaning of Article 22 GDPR. Enquiries, applications and account registrations are decided by people.

10. Links to external websites

Our pages contain links to third party websites. We have no influence on their content or their data processing. As soon as you follow such a link, the privacy notice of the respective provider applies.

11. Changes to this notice

We adapt this notice when our processing activities or the legal requirements change. The version published on this page is the one that applies. The date above shows the current status.