Legal
The following information provides a simple overview of what happens to your personal data when you visit this website, apply as a creator, book an appointment or log in to one of our portals. Personal data is any data that can be used to identify you personally.
The party responsible for data processing on this website is:
Gross Management — Ole Leander Gross (Einzelunternehmer (spanischer Autónomo))
Carrer de Girona 17
08172 Sant Cugat del Vallès, Barcelona, España
Phone: +34 600 64 51 54
Email: contact@grossmanagement.com
The responsible party is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data (e.g. names, email addresses, etc.).
We process personal data exclusively on the basis of the statutory provisions (in particular the GDPR and supplementary national data protection provisions). The relevant legal bases are in particular:
Art. 6 Abs. 1 lit. a DSGVO — Consent of the data subject.
Art. 6 Abs. 1 lit. b DSGVO — Performance of a contract or pre-contractual measures.
Art. 6 Abs. 1 lit. c DSGVO — Fulfilment of legal obligations.
Art. 6 Abs. 1 lit. f DSGVO — Safeguarding of legitimate interests.
This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. In doing so, Vercel processes technically necessary connection data and access logs to ensure the operation of the website, its security and delivery via the global edge network (CDN). The legal basis is Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in a secure, high-performance provision).
The transfer of data to third countries (in particular the USA) takes place on the basis of the EU-US Data Privacy Framework or EU standard contractual clauses. A data processing agreement (DPA) in accordance with Art. 28 DSGVO is in place with Vercel. Details at vercel.com/legal/privacy-policy.
The provider automatically collects and stores information in so-called server log files, which your browser transmits automatically. These are:
Browser type and browser version · operating system used · referrer URL · host name of the accessing computer · time of the server request · IP address.
This data is not merged with other data sources. Processing is based on Art. 6(1)(f) GDPR. Log data is retained only for as long as necessary to ensure operation and security, then deleted or anonymised.
Technically necessary cookies and similar storage technologies are always active (e.g. password protection, login session or a creator selection you actively create). In addition, we use Google Analytics 4 for anonymised audience measurement — but the required cookies are only set if you explicitly consent in the cookie banner. We do not use marketing or advertising cookies. Details are available in our Cookie Policy. The legal basis is Art. 6 Abs. 1 lit. f DSGVO or § 25 Abs. 2 Nr. 2 TDDDG (strictly necessary cookies).
If you consent in the cookie banner, we use Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; parent: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Analytics sets cookies (including "_ga" and "_ga_G-1M032XEED6") that enable an aggregated analysis of your use of the website (pages viewed, session duration, approximate country/region-level location, device and browser). The IP address is processed by Google in truncated form (IP anonymisation, `anonymize_ip:true`). Without your consent, Google Analytics is not loaded and no such cookies are set. Retention of user-level data on our GA property: 14 months (stream default).
The legal basis is your explicit consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG for storing the cookies. You can withdraw your consent at any time with effect for the future by clearing the local-storage entry "gm_cookie_consent" in your browser — the consent banner will reappear on your next visit. Google Ireland Limited may transfer data to the USA; transfers are based on the EU-US Data Privacy Framework or EU standard contractual clauses under Art. 46(2)(c) GDPR together with Google's supplementary technical and organisational measures. Access by US authorities cannot be fully excluded despite these safeguards. More on privacy at Google: policies.google.com/privacy.
When you apply as a creator or write to us via the contact form, we process the data you provide (e.g. name, city, email, social media handles, uploaded photos, free text) as well as publicly available data from your linked social media profiles in order to handle your enquiry or assess your profile. The legal basis is Art. 6 Abs. 1 lit. b DSGVO (pre-contractual measures) and Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in efficient processing).
The data is deleted as soon as it is no longer required for the respective purpose — at the latest 24 months after collection, provided that no statutory retention obligations apply.
We use service providers to operate the website and our services. Where they process personal data on our behalf, we conclude the agreements required by Art. 28 GDPR. Optional services such as Google Sign-In may also involve providers acting as independent controllers; their own privacy notices apply in addition.
We use Supabase Inc., 970 Toa Payoh North, #07-04, Singapore 318992, for authentication (email login and “Sign in with Google”), the storage of application and contact data as well as for our file storage (e.g. uploaded photos and profile material). Processed data includes, among other things, email address, hashed password, login metadata, IP address for session security and the profile and application content you provide.
The legal basis is Art. 6 Abs. 1 lit. b DSGVO (performance of contract) and Art. 6 Abs. 1 lit. f DSGVO (secure provision of the platform). A transfer to third countries (in particular the USA) may take place and is safeguarded by EU standard contractual clauses. Details at supabase.com/privacy.
For booking initial consultations we use Calendly LLC, 271 17th St NW, Atlanta, GA 30363, USA. The service loads only after you actively select it. From then on, technical connection data and the data you enter, including your name, email address, chosen appointment and optional details, may be transferred to and processed by Calendly.
The legal basis is Art. 6 Abs. 1 lit. b DSGVO (initiation of a contract) and Art. 6 Abs. 1 lit. f DSGVO (efficient appointment coordination). Calendly is a US provider; the transfer takes place on the basis of the EU-US Data Privacy Framework or EU standard contractual clauses. Please note that, despite these protective measures, access by US authorities cannot be entirely ruled out. Details at calendly.com/privacy.
We offer you the option of logging in via your Google account (“Sign in with Google”). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you sign in, the data required for authentication (including Google user ID, verified email address, name, profile picture) is transmitted to us by Google and stored in our auth database (Supabase).
The legal basis is Art. 6 Abs. 1 lit. a DSGVO (consent through active selection of the Google login) and Art. 6 Abs. 1 lit. b DSGVO (performance of contract). A transfer to the USA may take place and is safeguarded by the EU-US Data Privacy Framework or EU standard contractual clauses. Details at policies.google.com/privacy.
For sending confirmation and notification emails (e.g. when you submit an application, enquiry or appointment booking) we use Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). The data required for dispatch is processed, in particular email address, name and the content of the respective message.
The legal basis is Art. 6 Abs. 1 lit. b DSGVO (initiation/performance of a contract) and Art. 6 Abs. 1 lit. f DSGVO (efficient communication). Resend is a US provider; the transfer takes place on the basis of EU standard contractual clauses. Details at resend.com/legal/privacy-policy.
Recipients of personal data include the service providers named above, Google as an independent controller when Google Sign-In is used, and authorities where we are legally required to disclose data. Transfers to third countries may occur when using Vercel, Supabase, Calendly, Google and Resend. They take place only where the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision or appropriate safeguards such as EU standard contractual clauses.
We retain personal data only for as long as necessary for the stated purposes. We generally delete application and enquiry records after no more than 24 months unless a further relationship or overriding retention obligation applies. We retain account, contract and invoice data for the duration of the relationship and then in accordance with applicable statutory retention obligations. Data is then deleted or anonymised.
You have the right at any time to:
Access (Art. 15 DSGVO) to the data stored about you,
Rectification (Art. 16 DSGVO) of inaccurate data,
Erasure (Art. 17 DSGVO),
Restriction of processing (Art. 18 DSGVO),
Objection to the processing (Art. 21 DSGVO),
Data portability (Art. 20 DSGVO).
To exercise these rights, simply contact us at contact@grossmanagement.com.
You can withdraw consent already given at any time with effect for the future. The lawfulness of the processing carried out up to the withdrawal remains unaffected by the withdrawal.
Without prejudice to any other legal remedy, you have the right to lodge a complaint with a data protection supervisory authority — in particular in the member state of your place of residence, your place of work or the place of the alleged infringement (Art. 77 DSGVO). The supervisory authority responsible for us is: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.
Automated decision-making within the meaning of Art. 22 DSGVO, including profiling, does not take place.
We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to reflect changes to our services. The new privacy policy then applies to your next visit.
