Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

If you have any questions about how we handle your data, please contact us at the email address above.

2. What Data We Collect

We collect only the information you voluntarily provide when you submit our contact form. This may include:

• First name and last name — to address you correctly in correspondence
• Business email address — to respond to your enquiry and send a confirmation
• Business name — to understand your business context
• Service interest and message — to tailor our response to your needs

We do not collect payment information, sensitive personal data, or any data from minors under 16 years of age.

If you accept our analytics cookie, we may also collect anonymised usage data (pages visited, session duration, device type) via Google Analytics. No personally identifiable data is collected through analytics.

3. Legal Basis for Processing

We process your personal data under the following legal bases as defined by the GDPR (Article 6):

• Legitimate interest (Art. 6(1)(f)): Responding to business enquiries submitted through our contact form is in our legitimate interest as an active business.
• Consent (Art. 6(1)(a)): By submitting the contact form, you consent to us processing your data to respond to your enquiry. For analytics cookies, consent is collected explicitly through our cookie banner.
• Contractual necessity (Art. 6(1)(b)): If we enter into a service agreement with you, we will process your data as necessary to fulfil that contract.

4. How We Use Your Data

Your data is used exclusively for the following purposes:

• Responding to your enquiry within 24 hours
• Scheduling and confirming a free discovery call
• Sending a follow-up if agreed during the call
• Sending a service proposal or invoice if applicable

We will never sell your personal data to third parties, use it for unrelated marketing, or share it with advertisers.

5. Data Retention

We retain your personal data for as long as necessary to fulfil the purpose for which it was collected, subject to the following:

• Contact form submissions: deleted within 24 months of the last contact between us
• If you become a client: retained for the duration of the engagement plus the legally required period (typically 10 years for business records under German law)
• Analytics data: subject to Google Analytics' own retention policy (configurable, default 26 months)

If you request deletion of your data, we will action it within 30 days (subject to any legal retention obligations).

6. Third-Party Processors

We use the following third-party services that may process your data on our behalf:

• Netlify — form hosting and submission processing. Data processed on servers in the USA (Netlify is Privacy Shield / SCCs compliant). See: netlify.com/privacy
• Google Analytics (if cookies accepted) — anonymised website analytics. Google LLC, USA. See: policies.google.com/privacy
• Calendly (if you book via our scheduler) — appointment scheduling. Calendly LLC, USA. See: calendly.com/privacy

All third-party processors are contractually bound to process your data only as instructed and in accordance with applicable data protection laws.

7. International Data Transfers

Some third-party processors are based in the United States. Transfers outside the EEA are covered by appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent mechanisms.

8. Your Rights Under GDPR

As a data subject in the EU/EEA, you have the following rights:

• Right of access (Art. 15): Request a copy of the personal data we hold about you
• Right to rectification (Art. 16): Request correction of inaccurate data
• Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to restrict processing (Art. 18): Request we limit how we use your data
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interests
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at: hello@velocityaigroup.co

We will respond within 30 days. You also have the right to lodge a complaint with the relevant supervisory authority — in Germany, this is the Landesbeauftragter für den Datenschutz Baden-Württemberg.

9. Cookies

We use cookies in the following categories:

• Strictly necessary: Session and preference cookies required for the website to function. No consent needed.
• Analytics (optional): Google Analytics cookies, only loaded if you click "Accept" on our cookie banner. You can change your preference at any time by clearing your browser's local storage.

We do not use advertising or tracking cookies.

10. Data Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or alteration. Our website is served over HTTPS and form submissions are encrypted in transit.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of our website after changes constitutes acceptance of the updated policy.

12. Contact for Data Requests