heartstocks GmbH. Controller pursuant to GDPR.
Controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:
Neuer Wall 54
20354 Hamburg
Germany
Privacy enquiries. Access, erasure, objection.
For all questions concerning data protection and to exercise your rights, please contact:
Principles of processing. Scope, legal bases, retention.
We process personal data of our users only insofar as this is necessary to provide a functional website and our content and services, where you provide data voluntarily (e.g. via our chatbot), or where you have consented to the processing.
- Art. 6 (1) lit. a GDPR, consent
- Art. 6 (1) lit. b GDPR, contract / pre-contractual measures
- Art. 6 (1) lit. f GDPR, legitimate interest
Data is erased once the purpose for storage no longer applies. Longer retention applies where commercial or tax law obliges us, typically 6 or 10 years pursuant to §§ 257 HGB, 147 AO.
Hosting & server logs. Vercel, EU region Frankfurt.
Our website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA ("Vercel"). A data processing agreement under Art. 28 GDPR is in place with Vercel. Processing takes place in Vercel's EU region ("Frankfurt, fra1") wherever technically possible.
Transfers to the USA are based on the EU-US Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023) and supplementary Standard Contractual Clauses (Art. 46 (2) lit. c GDPR). Vercel is certified under the EU-US DPF.
On each request we automatically collect:
- IP address (shortened/anonymised where possible)
- Date and time of access
- URL requested and HTTP status code
- Volume of data transferred
- User-agent (browser, operating system)
- Referrer URL
We use Vercel Web Analytics and Vercel Speed Insights provided by Vercel Inc. (see section 4.1) to evaluate the use of our website statistically (e.g. number of page views, most visited pages, referring sites) and to measure the loading times of our pages. Neither service sets cookies or stores a persistent identifier on your device.
Web Analytics distinguishes visits by means of a hash value derived from the incoming request, which is discarded after 24 hours. According to Vercel, the data is collected anonymously and is not associated with any individual or IP address; visitors are not recognised across several days or across other websites. We only receive aggregated statistics.
Contact by email.
When you contact us by email, we store your details (email address, name, content of message) to process your enquiry.
Necessary, everything else only with consent. § 25 TDDDG, Art. 6 GDPR.
Without your consent we use only strictly necessary cookies and local storage objects required to operate the website, to store your cookie choice and to operate the chatbot.
If you consent to the category "Analytics & customer care (HubSpot, Leadfeeder)" in the cookie banner, we load the tracking code of our CRM system HubSpot (and additionally Leadfeeder, see section 6.3). HubSpot then stores cookies in your browser, recognises your browser on later visits and evaluates which pages you visit, how many sessions take place and through which sources you reach our website. If you later provide us with your contact details (e.g. in the chatbot, see section 7.9), we link your previous page views to your contact in our CRM in order to handle your enquiry better.
HubSpot also uses the IP address to identify which company a visit can be attributed to (company identification). This attribution is based on the IP address and is therefore not always accurate, for example in the case of shared networks or VPN connections.
With your consent to the category "Analytics & customer care (HubSpot, Leadfeeder)" we additionally load the Leadfeeder tracker. Leadfeeder matches the IP address of your visit against its own databases that map IP addresses to companies and shows us which company a visit originates from, which pages were viewed, when and via which source the visit took place. This allows us to identify companies interested in our offering and to prepare contacting them. We may transfer this information into our CRM HubSpot as a company record including the pages visited.
The attribution is based on the IP address and is therefore not always accurate, for example in the case of shared networks or VPN connections. If the HubSpot identifier (cookie hubspotutk, section 6.2) is already stored in your browser, the tracker also transmits it to Leadfeeder.
AI-assisted initial review. Anthropic Claude · HeyGen · Supabase · HubSpot.
On our website we offer an AI-assisted chatbot for an initial review of potential engagements. The chatbot asks questions about your project and collects voluntary information during the conversation to enable an initial assessment and, where appropriate, prepare a follow-up call with our team.
- Name (contact person)
- Email address
- Phone number (optional)
- Company name, registered office, website
- Description of your project or request
- planned investment or project volume
- further information from the open chat exchange
- Session and conversation ID
- Time and course of the conversation
- Input mode (text / video)
To generate the chatbot's answers we use the API of Anthropic, PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA ("Anthropic"). Your input, including the conversation history, is transmitted to Anthropic for response generation.
We optionally offer a video mode in our project concierge chatbot in which you can interact by voice with an AI avatar (digital twin of our Managing Director Enno Henke). The video mode is optional and is only activated if you expressly select "Chat & Video" in the consent dialog.
When you use the video mode, in addition to the data named in the chatbot section the following personal data is processed:
- Your voice recording during the session (audio stream)
- The automated transcription of your speech
- The avatar's speech output (synthetic voice)
For the video mode, HeyGen, Inc. engages the following sub-processors. All three providers are based in the USA; the data transfer is safeguarded by your explicit consent and additionally by Standard Contractual Clauses.
Conversations, contact data you provide and related metadata are stored in a database of Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992.
No decision producing legal effects concerning you and based solely on automated processing within the meaning of Art. 22 GDPR takes place. The decision to enter into a business relationship is always made by an employee of heartstocks GmbH.
Please do not submit any special categories of personal data within the meaning of Art. 9 GDPR (e.g. health data, religious or philosophical beliefs, biometric data) via the chatbot. Only enter data whose processing is actually necessary to handle your request.
Once you have provided your contact details in the chat and your enquiry has been fully recorded, we transmit your contact details (name, email address, phone number, company) and your project details (e.g. asset class, planned volume, timeline, investor type) and an AI-assisted summary to our CRM system HubSpot. We handle your enquiry there and get in touch with you.
If you have previously consented to HubSpot cookies (section 6.2), we additionally transmit the pseudonymous HubSpot cookie identifier of your browser and the address (without parameters) and title of the page on which you used the chat. As a result, your previous page views on our website are linked to your contact. Without this consent, no such link is made.
Data processors. Overview of engaged service providers.
Your data will not be passed on to third parties for purposes other than those listed here. In particular, we do not pass on your data for advertising purposes.
Data subject rights. Access. Rectification. Erasure.
You have the following rights vis-à-vis us regarding personal data concerning you:
- Art. 15 DSGVORight of access
- Art. 16 DSGVORight to rectification
- Art. 17 DSGVORight to erasure
- Art. 18 DSGVORight to restriction of processing
- Art. 20 DSGVORight to data portability
- Art. 21 DSGVORight to object
- Art. 7 Abs. 3 DSGVORight to withdraw consent
To exercise these rights, an informal email is sufficient:
Supervisory authority. Art. 77 GDPR.
Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.
The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Str. 22, 7. OG
20459 Hamburg
Technical & organisational measures. Art. 32 GDPR.
We implement technical and organisational security measures pursuant to Art. 32 GDPR to protect your data against accidental or intentional manipulation, partial or total loss, destruction or unauthorised access. Transmission between your browser and our server is encrypted via TLS (HTTPS). Access to stored data is restricted to a narrowly defined group of authorised persons.
Changes to this statement.
This privacy statement is currently valid and dated 29 September 2026. Further development of our website and offerings or changed legal or regulatory requirements may make amendments to this statement necessary. The current version is available on this page at any time.