Privacy Policy

This is a courtesy translation. Only the German version at /de/datenschutz is legally binding.

In short

This site is built so that simply reading it produces as little data as possible:

Reading sets no cookies. Neither our own nor anyone else’s.
Loading a page contacts no server outside this website. Fonts, images, scripts and even the analytics are served from this domain. That is why there is no consent banner here — not because one was hidden, but because reading gives you nothing to consent to.
External services are involved only after a deliberate action: playing a podcast episode, using the contact form, or subscribing to the newsletter. Playing an episode is where YouTube sets cookies — the only place on this site where cookies arise at all, and only through your click. Each section below states what happens.

1. Controller

The controller under the General Data Protection Regulation (GDPR) is:

EnRo UG (haftungsbeschränkt) Graisch 12 91278 Pottenstein Germany

Managing Director: Sascha Röhrer Email: [email protected]

No data protection officer has been appointed. The obligation only applies where at least 20 people are permanently engaged in the automated processing of personal data (§ 38 BDSG), which is not the case here.

2. Your rights

You have the right at any time to access the data stored about you (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20). On the right to object, see the separately highlighted paragraph below.

Where you have given consent — for the newsletter, for example — you may withdraw it at any time with effect for the future. The lawfulness of processing carried out until then is unaffected.

An informal message to the address above is enough for any of this.

Right to object under Art. 21 GDPR

Where we process data on the basis of a legitimate interest — on this site that means operating it and measuring reach — you have the right, on grounds relating to your particular situation, to object to that processing at any time. We will then stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

An informal message to [email protected] is enough.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the EU member state of your residence or the place of the alleged infringement. The competent authority for the controller’s registered address is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

3. Visiting the site (hosting and server logs)

The site is hosted on Cloudflare Pages, provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, represented in Europe by Cloudflare Germany GmbH.

When a page is requested, Cloudflare processes technically necessary data including your IP address, the date and time of the request, the address requested, the referring page, and details of your browser and operating system. This is required to deliver the page, keep it stable and fend off attacks.

Legal basis: Art. 6(1)(f) GDPR — the legitimate interest in the secure and reliable operation of the site.
Processing agreement: a data processing agreement under Art. 28 GDPR is in place with Cloudflare.
Retention: Cloudflare keeps these log entries only briefly and then deletes or anonymises them. We do not store your IP address permanently and do not evaluate these logs in any person-related way.
Third country: Cloudflare is a US company certified under the EU-US Data Privacy Framework; the EU standard contractual clauses apply in addition. Delivery runs through European data centres.

4. Analytics with Plausible

Reach is measured with Plausible Analytics, provided by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. Data is processed and stored in the European Union.

Plausible works deliberately differently from usual analytics tools:

No cookies are set and no information is stored on or read from your device. Consent under § 25 TDDDG is therefore not required.
No cross-device profile is built and you are not recognised across page views.
Your IP address is not stored. It only feeds into a value that is also built from a randomly rotating daily salt and cannot be reversed.
The measurement script is served from this domain and the measurements travel through this domain. Your browser makes no direct connection to Plausible.

What is collected: the page requested, the referrer, approximate origin at country level, device type and browser. Individual events without any personal reference are counted in addition — that a newsletter form was submitted, or that the calendar file was downloaded.

Legal basis: Art. 6(1)(f) GDPR, the legitimate interest in a data-minimising statistical evaluation of usage.
Objection: since no personal data is stored, no attribution to you is possible. You can still switch the measurement off for your browser: open the developer console and set localStorage.plausible_ignore = "true". The script checks that entry on every page and stops counting you.

The browser’s “Do Not Track” setting does not work here — Plausible deliberately ignores it, on the grounds that the measurement carries no personal reference in the first place. Content blockers are unreliable too, because the script is served from this domain rather than a known tracking address. We name the route that actually works instead of one that merely sounds reassuring.

5. Contact form and email

When you use the contact form we process the details you enter — name, email address, the category you select and your message — in order to answer your enquiry.

Delivery: the message is delivered through Resend, provided by Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA; for this site the EU region (Ireland) is configured. A processing agreement is in place; the EU standard contractual clauses apply to transfers to the USA.

Spam protection: Cloudflare Turnstile (Cloudflare, Inc., address as above) guards against automated submissions. Turnstile is loaded only once you actually interact with the form, not when the page is opened. Your IP address and technical details of your browser and device are transmitted to Cloudflare to check whether the input comes from a human. The form also contains a field invisible to people that only automated programs fill in; if it is filled in, we discard the submission.

Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns a contract, otherwise Art. 6(1)(f) — the legitimate interest in answering enquiries and in protection against misuse.
Retention: we keep your enquiry for as long as it is needed to handle it, and beyond that only where statutory retention obligations apply. It is deleted afterwards.

If you write to us directly by email instead, the same applies to the details in your message.

Signup and confirmation. Your email address is all that is needed. After submitting, you receive a message with a confirmation link; only when you click it do we add you (double opt-in). Nothing is sent to you before that. The procedure also documents your consent.

Scope. If you subscribe through one of our event overviews — the gamescom side events page, for instance — you are subscribing to the Working on Tomorrow newsletter and additionally receive notice of newly added events. Both are part of the same signup and are stated explicitly in the form before you submit it. Subscribing is voluntary; the event list, the filters and the calendar file are fully available without it.

Processor. Sending and administration run through Brevo, provided by Brevo SAS, 106 Boulevard Haussmann, 75008 Paris, France; processing takes place in the European Union. A processing agreement is in place.

Performance measurement. Brevo records whether a message was delivered and opened and whether links were clicked. That evaluation is person-related and is therefore part of the consent you give when subscribing — it is named explicitly in the signup form rather than buried in this policy. It serves to spot delivery problems and improve the content. Withdrawing consent by unsubscribing ends it as well.

Stored are your email address, the time of signup and confirmation, and the page you signed up from. The origin page serves as evidence of what your consent related to.

Existing Substack publication. Working on Tomorrow also appears on Substack (Substack Inc., 548 Market St, San Francisco, CA 94104, USA) and as a newsletter on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). Clicking one of those links takes you off this website; from then on the respective provider’s privacy terms apply, over whose processing we have no influence.

Legal basis: Art. 6(1)(a) GDPR (consent).
Withdrawal: every message contains an unsubscribe link. Unsubscribing takes effect immediately and your address is then deleted. We retain only the record of the original consent, for as long as that is needed to defend against possible claims.

7. Podcast playback

Episodes of deeptech INSIGHTS are embedded on this site through YouTube. Simply opening the podcast page does none of this: cover art and preview images are served from this domain, and no connection to YouTube exists.

Only when you click play is the YouTube player loaded. At that point your IP address and technical details of your device are transmitted to YouTube, and YouTube stores information on your device. If you are signed in to Google at the time, YouTube can associate the playback with your account; you can prevent that by signing out of Google before you play.

We embed the player through the address youtube-nocookie.com. That variant stores information on your device only once playback starts, not already when the page loads.

For users in the European Economic Area the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, part of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent). You give that consent by clicking play, having been told what it does by the note directly below the player. Without that click nothing is loaded and nothing is stored.
Withdrawal: reload the page without playing again — that ends the embedding. We do not store your decision; every visit starts again with no connection to YouTube. Data already transmitted is governed by Google’s privacy policy.
Third country: data may be transmitted to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. For transfers to certified companies the European Commission established an adequate level of protection by its decision of 10 July 2023, so the transfer rests on Art. 45 GDPR.
Further information: Google’s privacy policy is at https://policies.google.com/privacy.

Under each episode you will also find references to the same episode on Spotify, Apple Podcasts and YouTube. These are ordinary links: merely displaying them loads nothing from those providers. Only your click takes you to their sites, where their own privacy policies apply.

The episodes are hosted at Flightcast, Inc., USA, which distributes them to the podcast platforms. That is irrelevant for this website: your browser opens no connection to Flightcast. Cover art is downloaded while the pages are built and served from this domain, and playback runs exclusively through YouTube.

8. Event overviews

The side event overview and the calendar file (.ics) generated from it contain nothing but event details — date, time, venue, organiser and the address of the respective signup page. Opening the page or downloading the file collects no personal data about you beyond the server logs described in section 3. The filters work entirely in your browser; nothing is sent to a server in the process.

9. Language preference

If you switch between the German and English versions, your browser remembers that choice locally on your device so the language hint does not appear again. This entry is never transmitted to a server and contains nothing but the code of the chosen language. You can delete it at any time through your browser’s settings.

The storage falls under § 25 TDDDG but is exempt from consent under § 25(2) no. 2: it is strictly necessary to provide the function you asked for — keeping the language you chose.

10. Recipients at a glance

Service	Purpose	Provider and location	When
Cloudflare Pages	hosting, delivery, attack mitigation	Cloudflare, Inc., USA / EU data centres	every request
Plausible	analytics without personal reference	Plausible Insights OÜ, Estonia (EU)	every request, via this domain
Cloudflare Turnstile	contact form protection	Cloudflare, Inc., USA	only when the form is used
Resend	delivery of the form message	Resend, Inc., USA / EU region Ireland	only on submission
Brevo	newsletter sending and administration	Brevo SAS, France (EU)	only on signup
YouTube	podcast playback	Google Ireland Limited, Ireland (EU); Google LLC, USA (EU-US Data Privacy Framework)	only on playback

11. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

12. Changes to this policy

We update this privacy policy when the processing described here changes — for instance when a service is added or removed. The version published here applies; the date of the last change appears at the top of the page.